diff --git a/packages/ui/src/context/marked.tsx b/packages/ui/src/context/marked.tsx
index 3cf17443742..1da6f16d2ac 100644
--- a/packages/ui/src/context/marked.tsx
+++ b/packages/ui/src/context/marked.tsx
@@ -632,12 +632,18 @@ export const { use: useMarked, provider: MarkedProvider } = createSimpleContext(
           // kilocode_change start
           codespan({ text }) {
             const file = parseFilePath(text)
+            const escaped = text
+              .replace(/&/g, "&")
+              .replace(/</g, "&lt;")
+              .replace(/>/g, "&gt;")
+              .replace(/"/g, "&quot;")
+              .replace(/'/g, "&#39;")
             if (file) {
               const lineAttr = file.line ? ` data-file-line="${file.line}"` : ""
               const colAttr = file.column ? ` data-file-col="${file.column}"` : ""
-              return `<code class="file-link" data-file-path="${file.path}"${lineAttr}${colAttr}>${text}</code>`
+              return `<code class="file-link" data-file-path="${file.path}"${lineAttr}${colAttr}>${escaped}</code>`
             }
-            return `<code>${text}</code>`
+            return `<code>${escaped}</code>`
           },
           code({ text, lang }) {
             const escaped = text