diff --git a/packages/vite/package.json b/packages/vite/package.json
index 3f3c15934cc197..33e55befd6170b 100644
--- a/packages/vite/package.json
+++ b/packages/vite/package.json
@@ -78,6 +78,7 @@
"@rollup/plugin-node-resolve": "14.1.0",
"@rollup/plugin-typescript": "^8.5.0",
"@rollup/pluginutils": "^4.2.1",
+ "@types/escape-html": "^1.0.0",
"acorn": "^8.8.1",
"acorn-walk": "^8.2.0",
"cac": "^6.7.14",
@@ -92,6 +93,7 @@
"dotenv": "^14.3.2",
"dotenv-expand": "^5.1.0",
"es-module-lexer": "^1.1.0",
+ "escape-html": "^1.0.3",
"estree-walker": "^3.0.1",
"etag": "^1.8.1",
"fast-glob": "^3.2.12",
diff --git a/packages/vite/src/node/server/middlewares/static.ts b/packages/vite/src/node/server/middlewares/static.ts
index c877022a63cde7..d9eadc4fee8cb7 100644
--- a/packages/vite/src/node/server/middlewares/static.ts
+++ b/packages/vite/src/node/server/middlewares/static.ts
@@ -3,6 +3,7 @@ import type { OutgoingHttpHeaders, ServerResponse } from 'node:http'
import type { Options } from 'sirv'
import sirv from 'sirv'
import type { Connect } from 'dep-types/connect'
+import escapeHtml from 'escape-html'
import type { ViteDevServer } from '../..'
import { FS_PREFIX } from '../../constants'
import {
@@ -208,7 +209,7 @@ function renderRestrictedErrorHTML(msg: string): string {
return html`
403 Restricted
- ${msg.replace(/\n/g, '
')}
+ ${escapeHtml(msg).replace(/\n/g, '
')}