diff --git a/src/usr/local/www/guiconfig.inc b/src/usr/local/www/guiconfig.inc
index 194ce68348..7902da1d86 100644
--- a/src/usr/local/www/guiconfig.inc
+++ b/src/usr/local/www/guiconfig.inc
@@ -988,6 +988,7 @@ function alias_info_popup($alias_id, $is_system_alias = false) {
 		} else {
 			$urlfn = alias_expand_urltable($alias['name']);
 			$alias_addresses = empty($urlfn) ? [] : explode("\n", file_get_contents($urlfn));
+			$alias_addresses = array_map('htmlspecialchars', $alias_addresses);
 			$counter = count($alias_addresses);
 		}