diff --git a/src/components/user_card/user_card.js b/src/components/user_card/user_card.js
index dd8577233..a77406ca5 100644
--- a/src/components/user_card/user_card.js
+++ b/src/components/user_card/user_card.js
@@ -1,3 +1,4 @@
+import ldEscape from 'lodash/escape'
 import isEqual from 'lodash/isEqual'
 import merge from 'lodash/merge'
 import ldUnescape from 'lodash/unescape'
@@ -159,6 +160,9 @@ export default {
     this.$store.dispatch('fetchUserRelationship', this.user.id)
   },
   computed: {
+    escapedNewBio() {
+      return ldEscape(this.newBio).replace(/\n/g, '<br>')
+    },
     somethingToSave() {
       if (this.newName !== this.user.name_unescaped) return true
       if (this.newBio !== ldUnescape(this.user.description)) return true
diff --git a/src/components/user_card/user_card.vue b/src/components/user_card/user_card.vue
index 66529f59b..f5ddf9a8c 100644
--- a/src/components/user_card/user_card.vue
+++ b/src/components/user_card/user_card.vue
@@ -358,7 +358,7 @@
         v-if="!hideBio"
         class="user-card-bio"
         :class="{ '-justify-left': mergedConfig.userCardLeftJustify }"
-        :html="editable ? newBio.replace(/\n/g, '<br>') : user.description_html"
+        :html="editable ? escapedNewBio : user.description_html"
         :emoji="editable ? emoji : user.emoji"
         :handle-links="true"
       />