diff --git a/src/usr/local/www/services_dhcpv6.php b/src/usr/local/www/services_dhcpv6.php
index c8b1aea10e..e5cb3f2df4 100644
--- a/src/usr/local/www/services_dhcpv6.php
+++ b/src/usr/local/www/services_dhcpv6.php
@@ -909,7 +909,7 @@ if (is_ipaddrv6($ifcfgip)) {
 				sprintf('%s - %s%s',
 					array_get_path($range, 'from'),
 					array_get_path($range, 'to'),
-					!empty($range['descr']) ? ' ('.$range['descr'].')' : null
+					!empty($range['descr']) ? ' ('.htmlspecialchars($range['descr']).')' : null
 				)
 			));
 			$first = false;