diff --git a/htroot/Crawler_p.html b/htroot/Crawler_p.html
index 4a4adc8f6..935999461 100644
--- a/htroot/Crawler_p.html
+++ b/htroot/Crawler_p.html
@@ -6,6 +6,7 @@
 <script type="text/javascript" src="js/ajax.js"></script>
 <script type="text/javascript" src="js/xml.js"></script>
 <script type="text/javascript" src="js/html.js"></script>
+<script type="text/javascript" src="js/yacyutils.js"></script>
 <script type="text/javascript" src="js/rss2.js"></script>
 <script type="text/javascript" src="js/query.js"></script>
 <script type="text/javascript" src="js/Crawler.js"></script>
diff --git a/htroot/js/Crawler.js b/htroot/js/Crawler.js
index 3e840ac23..54a3963dc 100644
--- a/htroot/js/Crawler.js
+++ b/htroot/js/Crawler.js
@@ -411,7 +411,10 @@ function showRSS(RSS) {
   if (doc != null) {
     if (crawllist_body.length > 100000) crawllist_body = "";
     for (var i=0; i<RSS.items.length; i++) {
-      crawllist_body = "<tr class='TableCellLight'><td><a href='ViewFile.html?action=info&urlHash=" + RSS.items[i].guid.value + "' class='small' target='_blank' title='" + RSS.items[i].link + "'>" + RSS.items[i].description + "</a></td><td><a href='" + RSS.items[i].link + "' class='small' target='_blank' title='" + RSS.items[i].link + "'>" + RSS.items[i].link + "</a></td></tr>" + crawllist_body;
+      var guid = escapeHtml(RSS.items[i].guid.value);
+      var link = escapeHtml(RSS.items[i].link);
+      var description = escapeHtml(RSS.items[i].description);
+      crawllist_body = "<tr class='TableCellLight'><td><a href='ViewFile.html?action=info&urlHash=" + guid + "' class='small' target='_blank' title='" + link + "'>" + description + "</a></td><td><a href='" + link + "' class='small' target='_blank' title='" + link + "'>" + link + "</a></td></tr>" + crawllist_body;
     }
     doc.innerHTML = crawllist_head + crawllist_body + crawllist_tail;
   }
diff --git a/htroot/js/yacyutils.js b/htroot/js/yacyutils.js
new file mode 100644
index 000000000..782de1bab
--- /dev/null
+++ b/htroot/js/yacyutils.js
@@ -0,0 +1,29 @@
+/*    
+* Copyright (C) 2026 by Michael Peter Christen
+* This file is part of YaCy.
+* 
+* YaCy is free software: you can redistribute it and/or modify
+* it under the terms of the GNU General Public License as published by
+* the Free Software Foundation, either version 2 of the License, or
+* (at your option) any later version.
+* 
+* YaCy is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+* 
+* You should have received a copy of the GNU General Public License
+* along with YaCy.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+/*
+* Escape a string so it can be safely embedded into HTML (element text or attribute values).
+* Modeled after ServletResource.escapeHtml in source/net/yacy/http/servlets/ServletResource.java.
+* The single quote is additionally escaped so the result is safe for single-quoted attributes.
+* The ampersand must be replaced first to avoid double-encoding.
+*/
+function escapeHtml(value){
+  if (value == null) return "";
+  return String(value).replace(/&/g, "&amp;").replace(/"/g, "&quot;")
+    .replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/'/g, "&#39;");
+}
diff --git a/htroot/jslicense.html b/htroot/jslicense.html
index 8618f41c2..af3ce068d 100755
--- a/htroot/jslicense.html
+++ b/htroot/jslicense.html
@@ -203,6 +203,11 @@
 			<td><a href="http://www.gnu.org/licenses/gpl-2.0.html">GNU-GPL-2.0-or-later</a></td>
 			<td><a href="js/yacysort.js" charset="UTF-8">yacysort.js</a></td>
 		</tr>
+		<tr>
+			<td><a href="js/yacyutils.js" charset="UTF-8">yacyutils.js</a></td>
+			<td><a href="http://www.gnu.org/licenses/gpl-2.0.html">GNU-GPL-2.0-or-later</a></td>
+			<td><a href="js/yacyutils.js" charset="UTF-8">yacyutils.js</a></td>
+		</tr>
 		<tr>
 			<td><a href="portalsearch/yacy-portalsearch.js">yacy-portalsearch.js</a></td>
 			<td><a href="http://www.jclark.com/xml/copying.txt">Expat</a></td>