diff --git a/dashboard/package-lock.json b/dashboard/package-lock.json
index 1b24bf152e..de85dd1ad2 100644
--- a/dashboard/package-lock.json
+++ b/dashboard/package-lock.json
@@ -9,12 +9,14 @@
       "version": "0.1.0",
       "dependencies": {
         "@preact/signals-core": "^1.8.0",
+        "dompurify": "^3.4.13",
         "lit": "^3.2.1",
         "workbox-window": "^7.4.0"
       },
       "devDependencies": {
         "@axe-core/playwright": "^4.11.2",
         "@playwright/test": "^1.59.1",
+        "@types/dompurify": "^3.0.5",
         "typescript": "^5.6.3",
         "vite": "^5.4.10",
         "vite-plugin-pwa": "^1.2.0",
@@ -2529,6 +2531,16 @@
         "sourcemap-codec": "^1.4.8"
       }
     },
+    "node_modules/@types/dompurify": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-3.0.5.tgz",
+      "integrity": "sha512-1Wg0g3BtQF7sSb27fJQAKck1HECM6zV1EB66j8JH9i3LCjYabJa0FSdiSgsD5K/RbrsR0SiraKacLB+T8ZVYAg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/trusted-types": "*"
+      }
+    },
     "node_modules/@types/estree": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
@@ -3212,6 +3224,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/dompurify": {
+      "version": "3.4.13",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz",
+      "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/dashboard/package.json b/dashboard/package.json
index e99f9ae45e..b2a23e4312 100644
--- a/dashboard/package.json
+++ b/dashboard/package.json
@@ -16,12 +16,14 @@
   },
   "dependencies": {
     "@preact/signals-core": "^1.8.0",
+    "dompurify": "^3.4.13",
     "lit": "^3.2.1",
     "workbox-window": "^7.4.0"
   },
   "devDependencies": {
     "@axe-core/playwright": "^4.11.2",
     "@playwright/test": "^1.59.1",
+    "@types/dompurify": "^3.0.5",
     "typescript": "^5.6.3",
     "vite": "^5.4.10",
     "vite-plugin-pwa": "^1.2.0",
diff --git a/dashboard/src/components/nv-console.ts b/dashboard/src/components/nv-console.ts
index 1888ece742..9c53e4eeb5 100644
--- a/dashboard/src/components/nv-console.ts
+++ b/dashboard/src/components/nv-console.ts
@@ -2,6 +2,7 @@
 import { LitElement, html, css } from 'lit';
 import { customElement, query } from 'lit/decorators.js';
 import { effect } from '@preact/signals-core';
+import DOMPurify from 'dompurify';
 import {
   consoleLines, consoleFilter, consolePaused, pushLog,
   getClient, seed, theme, expectedWitness, witnessHex, witnessVerified,
@@ -251,7 +252,7 @@ export class NvConsole extends LitElement {
           return html`<div class="line ${l.level}">
             <div class="ts">${tsStr}</div>
             <div class="lvl">${l.level}</div>
-            <div class="msg" .innerHTML=${l.msg}></div>
+            <div class="msg" .innerHTML=${DOMPurify.sanitize(l.msg)}></div>
           </div>`;
         })}
       </div>