diff --git a/freqtrade/rpc/telegram.py b/freqtrade/rpc/telegram.py
index f9a0635f0..f28b26766 100644
--- a/freqtrade/rpc/telegram.py
+++ b/freqtrade/rpc/telegram.py
@@ -4,6 +4,7 @@
This module manage Telegram communication
"""
import asyncio
+import html
import json
import logging
import re
@@ -1378,7 +1379,7 @@ class Telegram(RPCHandler):
output = "Entry Tag Performance:\n"
for i, trade in enumerate(trades):
stat_line = (
- f"{i + 1}.\t {trade['enter_tag']}\t"
+ f"{i + 1}.\t {html.escape(trade['enter_tag'])}\t"
f"{fmt_coin(trade['profit_abs'], self._config['stake_currency'])} "
f"({trade['profit_ratio']:.2%}) "
f"({trade['count']})\n")
@@ -1410,7 +1411,7 @@ class Telegram(RPCHandler):
output = "Exit Reason Performance:\n"
for i, trade in enumerate(trades):
stat_line = (
- f"{i + 1}.\t {trade['exit_reason']}\t"
+ f"{i + 1}.\t {html.escape(trade['exit_reason'])}\t"
f"{fmt_coin(trade['profit_abs'], self._config['stake_currency'])} "
f"({trade['profit_ratio']:.2%}) "
f"({trade['count']})\n")
@@ -1442,7 +1443,7 @@ class Telegram(RPCHandler):
output = "Mix Tag Performance:\n"
for i, trade in enumerate(trades):
stat_line = (
- f"{i + 1}.\t {trade['mix_tag']}\t"
+ f"{i + 1}.\t {html.escape(trade['mix_tag'])}\t"
f"{fmt_coin(trade['profit_abs'], self._config['stake_currency'])} "
f"({trade['profit_ratio']:.2%}) "
f"({trade['count']})\n")