diff --git a/jupyter-js-widgets/src/utils.js b/jupyter-js-widgets/src/utils.js
index <HASH>..<HASH> 100644
--- a/jupyter-js-widgets/src/utils.js
+++ b/jupyter-js-widgets/src/utils.js
@@ -186,7 +186,7 @@ function typeset(element, text) {
  */
 var escape_html = function(text) {
     var esc  = document.createElement('div');
-    esc.innerHTML = text;
+    esc.textContent = text;
     return esc.innerHTML;
 };
Update escape_html function to return HTML character entity encoded characters based on input.