diff --git a/addons/pad/models/pad.py b/addons/pad/models/pad.py
index 45df365dc97..0393c9820b6 100644
--- a/addons/pad/models/pad.py
+++ b/addons/pad/models/pad.py
@@ -7,6 +7,7 @@ import re
 import string
 
 import requests
+from markupsafe import Markup
 
 from odoo import api, models, _
 from odoo.exceptions import UserError
@@ -99,7 +100,7 @@ class PadCommon(models.AbstractModel):
                     if mo:
                         content = mo.group(1)
 
-        return content
+        return Markup(content)
 
     # TODO
     # reverse engineer protocol to be setHtml without using the api key
diff --git a/addons/pad_project/views/project_portal_templates.xml b/addons/pad_project/views/project_portal_templates.xml
index 6981aaf1430..534e8fa2bf4 100644
--- a/addons/pad_project/views/project_portal_templates.xml
+++ b/addons/pad_project/views/project_portal_templates.xml
@@ -23,7 +23,7 @@
                     </div>
                 </t>
                 <t t-else="">
-                    <div class="py-1 px-2 bg-100 small" t-raw="task._get_pad_content()"/>
+                    <div class="py-1 px-2 bg-100 small" t-esc="task._get_pad_content()"/>
                 </t>
             </t>
             <t t-else="">