diff --git a/web/ui/react-app/src/pages/graph/Graph.tsx b/web/ui/react-app/src/pages/graph/Graph.tsx
index 332b3f4762..4422790cb9 100644
--- a/web/ui/react-app/src/pages/graph/Graph.tsx
+++ b/web/ui/react-app/src/pages/graph/Graph.tsx
@@ -10,6 +10,7 @@ import { Button } from 'reactstrap';
 import { FontAwesomeIcon } from '@fortawesome/react-fontawesome';
 import { faTimes } from '@fortawesome/free-solid-svg-icons';
 import { GraphDisplayMode } from './Panel';
+import { escapeHTML } from '../../utils';
 
 require('../../vendor/flot/jquery.flot');
 require('../../vendor/flot/jquery.flot.stack');
@@ -151,7 +152,7 @@ class Graph extends PureComponent<GraphProps, GraphState> {
 
     if (options.yaxis && isHeatmap) {
       options.yaxis.ticks = () => new Array(data.length + 1).fill(0).map((_el, i) => i);
-      options.yaxis.tickFormatter = (val) => `${val ? data[val - 1].labels.le : ''}`;
+      options.yaxis.tickFormatter = (val) => `${val ? escapeHTML(data[val - 1].labels.le) : ''}`;
       options.yaxis.min = 0;
       options.yaxis.max = data.length;
       options.series.lines = { show: false };