diff --git a/plugins/discourse-narrative-bot/lib/discourse_narrative_bot/base.rb b/plugins/discourse-narrative-bot/lib/discourse_narrative_bot/base.rb
index f2bbc9d3b1c..8d2ac628c57 100644
--- a/plugins/discourse-narrative-bot/lib/discourse_narrative_bot/base.rb
+++ b/plugins/discourse-narrative-bot/lib/discourse_narrative_bot/base.rb
@@ -119,10 +119,12 @@ module DiscourseNarrativeBot
         date: Time.zone.now.strftime('%b %d %Y'),
         format: :svg
       }
-
       options.merge!(type: type) if type
+      
       src = Discourse.base_url + DiscourseNarrativeBot::Engine.routes.url_helpers.certificate_path(options)
-      "<img class='discobot-certificate' src='#{src}' width='650' height='464' alt='#{I18n.t("#{self.class::I18N_KEY}.certificate.alt")}'>"
+      alt = CGI.escapeHTML(I18n.t("#{self.class::I18N_KEY}.certificate.alt"))
+      
+      "<img class='discobot-certificate' src='#{src}' width='650' height='464' alt='#{alt}'>"
     end
 
     protected