From 3c027bdc5822c7baa4cab0140d2ffebb4aae5f53 Mon Sep 17 00:00:00 2001
From: Aarol D'Souza <98270103+AarDG10@users.noreply.github.com>
Date: Fri, 27 Feb 2026 17:11:14 +0530
Subject: [PATCH] fix: escape avatar image (#37633)

---
 frappe/templates/includes/avatar_macro.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frappe/templates/includes/avatar_macro.html b/frappe/templates/includes/avatar_macro.html
index 5db1654ef5..bd59e83bfd 100644
--- a/frappe/templates/includes/avatar_macro.html
+++ b/frappe/templates/includes/avatar_macro.html
@@ -4,7 +4,7 @@
 	{% if image or user_info.image  %}
 	<img
 		class="avatar-frame standard-image"
-		src="{{ image or user_info.image }}"
+		src="{{ (image or user_info.image) |e }}"
 		title="{{ full_name|e or user_info.name|e }}">
 	{% else %}
 	<span