diff --git a/server/src/graphql.rs b/server/src/graphql.rs
index c5a7af9..ce8debc 100644
--- a/server/src/graphql.rs
+++ b/server/src/graphql.rs
@@ -350,7 +350,7 @@ impl QueryRoot {
                 Body::PlainText(PlainText { text, content_tree }) => Body::Html(Html {
                     html: format!(
                         r#"<p class="view-part-text-plain">{}</p>"#,
-                        linkify_html(&text)
+                        sanitize_html(&linkify_html(&text))?
                     ),
                     content_tree: if debug_content_tree {
                         render_content_type_tree(&m)