diff --git a/modoboa/static/js/global.js b/modoboa/static/js/global.js
index 6d1d1d722..0e6dbc5d1 100644
--- a/modoboa/static/js/global.js
+++ b/modoboa/static/js/global.js
@@ -346,7 +346,7 @@ function defaultAjaxErrorHandler(event, jqxhr, settings) {
     } catch (x) {
         data = gettext("Internal error");
     }
-    $('body').notify('error', data);
+    $('body').notify('error', htmlEncode(data));
 }
 
 /**