diff --git a/cmd/derper/derper.go b/cmd/derper/derper.go
index 838b27028..fda0333a6 100644
--- a/cmd/derper/derper.go
+++ b/cmd/derper/derper.go
@@ -13,6 +13,7 @@ import (
"expvar"
"flag"
"fmt"
+ "html"
"io"
"io/ioutil"
"log"
@@ -229,10 +230,10 @@ func debugHandler(s *derp.Server) http.Handler {
DERP debug
`)
- f("- Hostname: %v
\n", *hostname)
+ f("- Hostname: %v
\n", html.EscapeString(*hostname))
f("- Uptime: %v
\n", tsweb.Uptime())
f("- Mesh Key: %v
\n", s.HasMeshKey())
- f("- Version: %v
\n", version.LONG)
+ f("- Version: %v
\n", html.EscapeString(version.LONG))
f(`- /debug/vars (Go)
- /debug/varz (Prometheus)