diff --git a/src/components/studio/views/export-helpers.test.ts b/src/components/studio/views/export-helpers.test.ts
index 819784da..9f20f622 100644
--- a/src/components/studio/views/export-helpers.test.ts
+++ b/src/components/studio/views/export-helpers.test.ts
@@ -160,6 +160,22 @@ describe('buildHtmlExport', () => {
     expect(html).toContain('<script>')
   })
 
+  it('escapes HTML and attribute breakout in entity type and claim verification', () => {
+    const maliciousEntity: Entity = {
+      ...SAMPLE_ENTITIES[0],
+      type: 'concept"><script>alert("xss-type")</script>' as Entity['type'],
+    }
+    const maliciousClaim: Claim = {
+      ...SAMPLE_CLAIMS[0],
+      verification: 'verified"><script>alert("xss-claim")</script>' as Claim['verification'],
+    }
+    const html = buildHtmlExport([maliciousEntity], [maliciousClaim])
+    expect(html).not.toContain('<script>alert("xss-type")</script>')
+    expect(html).not.toContain('<script>alert("xss-claim")</script>')
+    expect(html).toContain('&quot;&gt;&lt;script&gt;alert(&quot;xss-type&quot;)&lt;/script&gt;')
+    expect(html).toContain('&quot;&gt;&lt;script&gt;alert(&quot;xss-claim&quot;)&lt;/script&gt;')
+  })
+
   it('preserves Markdown angle brackets in entity content', () => {
     const md: Entity[] = [{
       ...SAMPLE_ENTITIES[0],
diff --git a/src/components/studio/views/export-helpers.ts b/src/components/studio/views/export-helpers.ts
index d26a04e7..86c30db2 100644
--- a/src/components/studio/views/export-helpers.ts
+++ b/src/components/studio/views/export-helpers.ts
@@ -76,7 +76,9 @@ export const buildHtmlExport = (entities: Entity[], claims: Claim[]): string =>
         ? `<ul class="claims">${entityClaims
             .map(
               (c) =>
-                `<li><span class="v ${c.verification}">${c.verification}</span> ${escapeHtml(
+                `<li><span class="v ${escapeHtml(c.verification)}">${escapeHtml(
+                  c.verification,
+                )}</span> ${escapeHtml(
                   c.statement,
                 )} <span class="meta">(${Math.round(c.confidence * 100)}%)</span></li>`,
             )
@@ -84,7 +86,7 @@ export const buildHtmlExport = (entities: Entity[], claims: Claim[]): string =>
         : '<p class="meta">No claims.</p>'
       return `<article>
   <header>
-    <span class="type ${e.type}">${e.type}</span>
+    <span class="type ${escapeHtml(e.type)}">${escapeHtml(e.type)}</span>
     <h2>${escapeHtml(e.name)}</h2>
     <p class="meta">${e.tags.map((t) => `#${escapeHtml(t)}`).join(' ')}</p>
   </header>