diff --git a/index.html b/index.html
index e000e42..91e8c40 100644
--- a/index.html
+++ b/index.html
@@ -2415,7 +2415,10 @@
             const msgs = document.getElementById("chat-msgs");
             const div = document.createElement("div");
             div.className = "chat-msg chat-msg-" + role;
-            div.textContent = text;
+            // strip <script> and on* handlers to prevent XSS, but render safe HTML
+            div.innerHTML = text.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+                               .replace(/\son\w+\s*=\s*"[^"]*"/gi, '')
+                               .replace(/\son\w+\s*=\s*'[^']*'/gi, '');
             msgs.appendChild(div);
             msgs.scrollTop = msgs.scrollHeight;
             return div;