diff --git a/copyparty/web/md.js b/copyparty/web/md.js
index d2a7facd..b7328ebb 100644
--- a/copyparty/web/md.js
+++ b/copyparty/web/md.js
@@ -22,7 +22,9 @@ var dom_md = document.getElementById('mt');
         if (a > 0)
             loc.push(n[a]);
 
-        nav.push('<a href="/' + loc.join('/') + '">' + n[a] + '</a>');
+        var dec = decodeURIComponent(n[a]).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+
+        nav.push('<a href="/' + loc.join('/') + '">' + dec + '</a>');
     }
     dom_nav.innerHTML = nav.join('');
 })();
diff --git a/copyparty/web/mde.js b/copyparty/web/mde.js
index 71b9e752..5cc4c74f 100644
--- a/copyparty/web/mde.js
+++ b/copyparty/web/mde.js
@@ -13,7 +13,9 @@ var dom_md = document.getElementById('mt');
         if (a > 0)
             loc.push(n[a]);
 
-        nav.push('<a href="/' + loc.join('/') + '">' + n[a] + '</a>');
+        var dec = decodeURIComponent(n[a]).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+
+        nav.push('<a href="/' + loc.join('/') + '">' + dec + '</a>');
     }
     dom_nav.innerHTML = nav.join('');
 })();