diff --git a/www/manager/dc/AuthView.js b/www/manager/dc/AuthView.js
index 83e79c65..2a2961cc 100644
--- a/www/manager/dc/AuthView.js
+++ b/www/manager/dc/AuthView.js
@@ -132,6 +132,7 @@ Ext.define('PVE.dc.AuthView', {
 		    header: gettext('Comment'),
 		    sortable: false,
 		    dataIndex: 'comment',
+		    renderer: Ext.String.htmlEncode,
 		    flex: 1
 		}
 	    ],
diff --git a/www/manager/dc/GroupView.js b/www/manager/dc/GroupView.js
index 6950a46a..96127212 100644
--- a/www/manager/dc/GroupView.js
+++ b/www/manager/dc/GroupView.js
@@ -95,6 +95,7 @@ Ext.define('PVE.dc.GroupView', {
 		{
 		    header: gettext('Comment'),
 		    sortable: false,
+		    renderer: Ext.String.htmlEncode,
 		    dataIndex: 'comment',
 		    flex: 1
 		}
diff --git a/www/manager/dc/PoolView.js b/www/manager/dc/PoolView.js
index 4ae99e23..0d552ecd 100644
--- a/www/manager/dc/PoolView.js
+++ b/www/manager/dc/PoolView.js
@@ -96,6 +96,7 @@ Ext.define('PVE.dc.PoolView', {
 		    header: gettext('Comment'),
 		    sortable: false,
 		    dataIndex: 'comment',
+		    renderer: Ext.String.htmlEncode,
 		    flex: 1
 		}
 	    ],
diff --git a/www/manager/dc/SecurityGroups.js b/www/manager/dc/SecurityGroups.js
index 0e312958..d8562e74 100644
--- a/www/manager/dc/SecurityGroups.js
+++ b/www/manager/dc/SecurityGroups.js
@@ -167,7 +167,7 @@ Ext.define('PVE.SecurityGroupList', {
 	    selModel: sm,
 	    columns: [
 		{ header: gettext('Group'), dataIndex: 'group', width: 100 },
-		{ header: gettext('Comment'), dataIndex: 'comment', flex: 1 }
+		{ header: gettext('Comment'), dataIndex: 'comment', renderer: Ext.String.htmlEncode, flex: 1 }
 	    ],
 	    listeners: {
 		itemdblclick: run_editor,
diff --git a/www/manager/dc/UserView.js b/www/manager/dc/UserView.js
index c4f8a8b0..d4ad7137 100644
--- a/www/manager/dc/UserView.js
+++ b/www/manager/dc/UserView.js
@@ -220,6 +220,7 @@ Ext.define('PVE.dc.UserView', {
 		    id: 'comment',
 		    header: gettext('Comment'),
 		    sortable: false,
+		    renderer: Ext.String.htmlEncode,
 		    dataIndex: 'comment',
 		    flex: 1
 		}
diff --git a/www/manager/grid/FirewallAliases.js b/www/manager/grid/FirewallAliases.js
index 353b97c1..2f38393f 100644
--- a/www/manager/grid/FirewallAliases.js
+++ b/www/manager/grid/FirewallAliases.js
@@ -171,7 +171,7 @@ Ext.define('PVE.FirewallAliases', {
 	    columns: [
 		{ header: gettext('Name'), dataIndex: 'name', width: 100 },
 		{ header:  gettext('IP/CIDR'), dataIndex: 'cidr', width: 100 },
-		{ header: gettext('Comment'), dataIndex: 'comment', flex: 1 }
+		{ header: gettext('Comment'), dataIndex: 'comment', renderer: Ext.String.htmlEncode, flex: 1 }
 	    ],
 	    listeners: {
 		itemdblclick: run_editor
diff --git a/www/manager/ha/Groups.js b/www/manager/ha/Groups.js
index e596c00a..28be5f72 100644
--- a/www/manager/ha/Groups.js
+++ b/www/manager/ha/Groups.js
@@ -108,7 +108,8 @@ Ext.define('PVE.ha.GroupsView', {
 		{
 		    header: gettext('Comment'),
 		    flex: 1,
-		    dataIndex: 'comment'
+		    dataIndex: 'comment',
+		    renderer: Ext.String.htmlEncode
 		}
 	    ],
 	    listeners: {
diff --git a/www/manager/ha/Resources.js b/www/manager/ha/Resources.js
index 495f039b..87a9723f 100644
--- a/www/manager/ha/Resources.js
+++ b/www/manager/ha/Resources.js
@@ -133,7 +133,8 @@ Ext.define('PVE.ha.ResourcesView', {
 		{
 		    header: gettext('Description'),
 		    flex: 1,
-		    dataIndex: 'comment'
+		    dataIndex: 'comment',
+		    renderer: Ext.String.htmlEncode
 		}
 	    ],
 	    listeners: {
diff --git a/www/manager/lxc/SnapshotTree.js b/www/manager/lxc/SnapshotTree.js
index f13e64f5..cbe70430 100644
--- a/www/manager/lxc/SnapshotTree.js
+++ b/www/manager/lxc/SnapshotTree.js
@@ -279,7 +279,7 @@ Ext.define('PVE.lxc.SnapshotTree', {
 			if (record.data.name === 'current') {
 			    return gettext("You are here!");
 			} else {
-			    return value;
+			    return Ext.String.htmlEncode(value);
 			}
 		    }
 		}
diff --git a/www/manager/panel/IPSet.js b/www/manager/panel/IPSet.js
index 2aae7dfa..821f467f 100644
--- a/www/manager/panel/IPSet.js
+++ b/www/manager/panel/IPSet.js
@@ -148,7 +148,7 @@ Ext.define('PVE.IPSetList', {
 	    selModel: sm,
 	    columns: [
 		{ header: 'IPSet', dataIndex: 'name', width: 100 },
-		{ header: gettext('Comment'), dataIndex: 'comment', flex: 1 }
+		{ header: gettext('Comment'), dataIndex: 'comment', renderer: Ext.String.htmlEncode, flex: 1 }
 	    ],
 	    listeners: {
 		itemdblclick: run_editor,
diff --git a/www/manager/pool/StatusView.js b/www/manager/pool/StatusView.js
index 8049364e..a376e095 100644
--- a/www/manager/pool/StatusView.js
+++ b/www/manager/pool/StatusView.js
@@ -13,6 +13,7 @@ Ext.define('PVE.pool.StatusView', {
 	var rows = {
 	    comment: {
 		header: gettext('Comment'), 
+		renderer: Ext.String.htmlEncode,
 		required: true
 	    }
 	};
diff --git a/www/manager/qemu/Options.js b/www/manager/qemu/Options.js
index c31af13b..9ba913cb 100644
--- a/www/manager/qemu/Options.js
+++ b/www/manager/qemu/Options.js
@@ -242,6 +242,7 @@ Ext.define('PVE.qemu.Options', {
 	    smbios1: {
 		header: gettext('SMBIOS settings (type1)'),
 		defaultValue: '',
+		renderer: Ext.String.htmlEncode,
 		editor: caps.vms['VM.Config.HWType'] ? 'PVE.qemu.Smbios1Edit' : undefined
 	    },
 	    agent: {
diff --git a/www/manager/qemu/SnapshotTree.js b/www/manager/qemu/SnapshotTree.js
index 6f377a2c..6efa944b 100644
--- a/www/manager/qemu/SnapshotTree.js
+++ b/www/manager/qemu/SnapshotTree.js
@@ -279,7 +279,7 @@ Ext.define('PVE.qemu.SnapshotTree', {
 			if (record.data.name === 'current') {
 			    return gettext("You are here!");
 			} else {
-			    return value;
+			    return Ext.String.htmlEncode(value);
 			}
 		    }
 		}