diff --git a/src/inc/routes/tag_image.mjs b/src/inc/routes/tag_image.mjs
index fa0bee3..6c547c1 100644
--- a/src/inc/routes/tag_image.mjs
+++ b/src/inc/routes/tag_image.mjs
@@ -7,6 +7,21 @@ export default (router, tpl) => {
     // Create a deterministic hash from the tag
     const hash = crypto.createHash('md5').update(tag).digest('hex');
 
+    // Escape character for SVG
+    const escapeXml = (unsafe) => {
+      return unsafe.replace(/[<>&'"]/g, (c) => {
+        switch (c) {
+          case '<': return '&lt;';
+          case '>': return '&gt;';
+          case '&': return '&amp;';
+          case '\'': return '&apos;';
+          case '"': return '&quot;';
+        }
+      });
+    };
+
+    const displayTag = escapeXml(tag);
+
     // Generate colors from hash
     const c1 = '#' + hash.substring(0, 6);
     const c2 = '#' + hash.substring(6, 12);
@@ -27,7 +42,7 @@ export default (router, tpl) => {
         <rect width="300" height="150" fill="url(#grad)" />
         <circle cx="${n1}%" cy="${n2}%" r="${(n1 + n2) / 4}" fill="${c3}" fill-opacity="0.3" />
         <circle cx="${100 - n1}%" cy="${100 - n2}%" r="${(n1 + n2) / 3}" fill="${c3}" fill-opacity="0.2" />
-        <text x="50%" y="50%" dominant-baseline="middle" text-anchor="middle" font-family="sans-serif" font-size="24" fill="#fff" fill-opacity="0.9" font-weight="bold">${tag}</text>
+        <text x="50%" y="50%" dominant-baseline="middle" text-anchor="middle" font-family="sans-serif" font-size="24" fill="#fff" fill-opacity="0.9" font-weight="bold">${displayTag}</text>
       </svg>
     `.trim();