diff --git a/package.json b/package.json
index a37984fb0e6b..5c30c47e13c8 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,7 @@
     "esbuild": "0.28.1",
     "esbuild-sass-plugin": "3.7.0",
     "dequal": "2.0.3",
+    "dompurify": "3.4.11",
     "gettext-parser": "9.0.2",
     "ipaddr.js": "2.4.0",
     "json-stable-stringify-without-jsonify": "1.0.1",
diff --git a/pkg/packagekit/updates.jsx b/pkg/packagekit/updates.jsx
index 68b40fcf1bf5..08b4223836fd 100644
--- a/pkg/packagekit/updates.jsx
+++ b/pkg/packagekit/updates.jsx
@@ -46,6 +46,7 @@ import {
 } from "@patternfly/react-icons";
 import { TableText } from "@patternfly/react-table";
 import { Remarkable } from "remarkable";
+import DOMPurify from "dompurify";
 
 import { AutoUpdates, getBackend } from "./autoupdates.jsx";
 import { KpatchSettings, KpatchStatus } from "./kpatch";
@@ -321,8 +322,8 @@ function updateItem(remarkable, info, pkgNames, key) {
     descriptionFirstLine = cleanupChangelogLine(descriptionFirstLine);
     let description;
     if (info.markdown) {
-        descriptionFirstLine = <span dangerouslySetInnerHTML={{ __html: remarkable.render(descriptionFirstLine) }} />;
-        description = <div dangerouslySetInnerHTML={{ __html: remarkable.render(info.description) }} />;
+        descriptionFirstLine = <span dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(remarkable.render(descriptionFirstLine)) }} />;
+        description = <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(remarkable.render(info.description)) }} />;
     } else {
         description = <div className="changelog">{info.description}</div>;
     }