diff --git a/qutebrowser/mainwindow/prompt.py b/qutebrowser/mainwindow/prompt.py
index 3e2ea3999..63317e5b9 100644
--- a/qutebrowser/mainwindow/prompt.py
+++ b/qutebrowser/mainwindow/prompt.py
@@ -447,7 +447,8 @@ class _BasePrompt(QWidget):
 
     def _init_title(self, question):
         assert question.title is not None, question
-        title = '<font size="4"><b>{}</b></font>'.format(question.title)
+        title = '<font size="4"><b>{}</b></font>'.format(
+            html.escape(question.title))
         title_label = QLabel(title, self)
         self._vbox.addWidget(title_label)
         if question.text is not None: