diff --git a/qutebrowser/network/qutescheme.py b/qutebrowser/network/qutescheme.py
index 053884b09..e24c9b4ea 100644
--- a/qutebrowser/network/qutescheme.py
+++ b/qutebrowser/network/qutescheme.py
@@ -24,7 +24,7 @@ Module attributes:
     pyeval_output: The output of the last :pyeval command.
 """
 
-import cgi
+import html
 
 from PyQt5.QtNetwork import QNetworkReply
 
@@ -112,13 +112,13 @@ class QuteHandlers:
     @classmethod
     def pyeval(cls):
         """Handler for qute:pyeval. Return HTML content as bytes."""
-        text = cgi.escape(pyeval_output)
+        text = html.escape(pyeval_output)
         return _get_html('pyeval', '<pre>{}</pre>'.format(text))
 
     @classmethod
     def version(cls):
         """Handler for qute:version. Return HTML content as bytes."""
-        text = cgi.escape(version.version())
+        text = html.escape(version.version())
         html = '<h1>Version info</h1>'
         html += '<p>{}</p>'.format(text.replace('\n', '<br/>'))
         html += '<h1>Copyright info</h1>'
@@ -132,7 +132,7 @@ class QuteHandlers:
         if logutils.ram_handler is None:
             text = "Log output was disabled."
         else:
-            text = cgi.escape(logutils.ram_handler.dump_log())
+            text = html.escape(logutils.ram_handler.dump_log())
         return _get_html('log', '<pre>{}</pre>'.format(text))
 
     @classmethod
diff --git a/qutebrowser/utils/log.py b/qutebrowser/utils/log.py
index bb1b23e60..a30700840 100644
--- a/qutebrowser/utils/log.py
+++ b/qutebrowser/utils/log.py
@@ -22,7 +22,7 @@
 import re
 import os
 import sys
-import cgi
+import html
 import logging
 from contextlib import contextmanager
 from logging import getLogger
@@ -383,7 +383,7 @@ class HTMLFormatter(logging.Formatter):
         for field in ['msg', 'filename', 'funcName', 'levelname', 'module',
                       'name', 'pathname', 'processName', 'threadName']:
             data = str(getattr(record, field))
-            setattr(record, field, cgi.escape(data))
+            setattr(record, field, html.escape(data))
         message = super().format(record)
         if not message.endswith(self._colordict['reset']):
             message += self._colordict['reset']
@@ -391,4 +391,4 @@ class HTMLFormatter(logging.Formatter):
 
     def formatTime(self, record, datefmt=None):
         out = super().formatTime(record, datefmt)
-        return cgi.escape(out)
+        return html.escape(out)
diff --git a/scripts/generate_doc.py b/scripts/generate_doc.py
index ab90dbfbd..1078b2757 100755
--- a/scripts/generate_doc.py
+++ b/scripts/generate_doc.py
@@ -22,7 +22,7 @@
 import re
 import os
 import sys
-import cgi
+import html
 import shutil
 import inspect
 import subprocess
@@ -375,7 +375,7 @@ def generate_settings(f):
                             f.write(" * +{}+".format(val) + "\n")
                     f.write("\n")
                 if option.default:
-                    f.write("Default: +pass:[{}]+\n".format(cgi.escape(
+                    f.write("Default: +pass:[{}]+\n".format(html.escape(
                         option.default)))
                 else:
                     f.write("Default: empty\n")