diff --git a/app/src/dialog/processSystem.ts b/app/src/dialog/processSystem.ts
index 812efd8da..f18d50fc7 100644
--- a/app/src/dialog/processSystem.ts
+++ b/app/src/dialog/processSystem.ts
@@ -438,16 +438,16 @@ export const progressLoading = (data: IWebSocketData) => {
 <div class="b3-dialog__loading">
     <div style="text-align: right">${data.data.current}/${data.data.total}</div>
     <div style="margin: 8px 0;height: 8px;border-radius: var(--b3-border-radius);overflow: hidden;background-color:#fff;"><div style="width: ${data.data.current / data.data.total * 100}%;transition: var(--b3-transition);background-color: var(--b3-theme-primary);height: 8px;"></div></div>
-    <div class="ft__breakword">${data.msg}</div>
+    <div class="ft__breakword">${escapeHtml(data.msg)}</div>
 </div>`;
     } else if (data.code === 1) {
         if (progressElement.lastElementChild) {
-            progressElement.lastElementChild.lastElementChild.innerHTML = data.msg;
+            progressElement.lastElementChild.lastElementChild.innerHTML = escapeHtml(data.msg);
         } else {
             progressElement.innerHTML = `<div class="b3-dialog__scrim" style="opacity: 1"></div>
 <div class="b3-dialog__loading">
     <div style="margin: 8px 0;height: 8px;border-radius: var(--b3-border-radius);overflow: hidden;background-color:#fff;"><div style="background-color: var(--b3-theme-primary);height: 8px;background-image: linear-gradient(-45deg, rgba(255, 255, 255, 0.2) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.2) 50%, rgba(255, 255, 255, 0.2) 75%, transparent 75%, transparent);animation: stripMove 450ms linear infinite;background-size: 50px 50px;"></div></div>
-    <div class="ft__breakword">${data.msg}</div>
+    <div class="ft__breakword">${escapeHtml(data.msg)}</div>
 </div>`;
         }
     }