diff --git a/classes/Feeds.php b/classes/Feeds.php
index 242801891..a58c42e34 100644
--- a/classes/Feeds.php
+++ b/classes/Feeds.php
@@ -1035,7 +1035,7 @@ class Feeds extends Handler_Protected {
 				UrlHelper::$fetch_last_error .= " (feed behind Cloudflare)";
 			}
 
-			return array("code" => 5, "message" => UrlHelper::$fetch_last_error);
+			return array("code" => 5, "message" => truncate_string(UrlHelper::$fetch_last_error, 1000, '…'));
 		}
 
 		if (str_contains(UrlHelper::$fetch_last_content_type, "html") && self::_is_html($contents)) {
diff --git a/js/CommonDialogs.js b/js/CommonDialogs.js
index dcf25a566..124c8a17d 100644
--- a/js/CommonDialogs.js
+++ b/js/CommonDialogs.js
@@ -195,7 +195,7 @@ const	CommonDialogs = {
 													}
 													break;
 												case 5:
-													dialog.show_error(__("Couldn't download the specified URL: %s").replace("%s", rc['message']));
+													dialog.show_error(__("Couldn't download the specified URL: %s").replace("%s", App.escapeHtml(rc['message'])));
 													break;
 												case 6:
 													dialog.show_error(__("XML validation failed: %s").replace("%s", rc['message']));