diff --git a/packages/pluggableWidgets/html-element-web/package.json b/packages/pluggableWidgets/html-element-web/package.json
index 100f20cece..d14f644d86 100644
--- a/packages/pluggableWidgets/html-element-web/package.json
+++ b/packages/pluggableWidgets/html-element-web/package.json
@@ -48,6 +48,7 @@
     "@testing-library/react-hooks": "^3.4.2",
     "@testing-library/user-event": "^13.2.1",
     "@types/big.js": "^6.0.2",
+    "@types/dompurify": "^2.4.0",
     "@types/react": "^17.0.52",
     "@types/react-dom": "^17.0.18",
     "@types/react-test-renderer": "<18.0.0",
@@ -57,5 +58,8 @@
     "react": "~17.0.2",
     "react-dom": "~17.0.2",
     "react-test-renderer": "~17.0.2"
+  },
+  "dependencies": {
+    "dompurify": "^2.4.1"
   }
 }
diff --git a/packages/pluggableWidgets/html-element-web/src/components/HTMLTag.tsx b/packages/pluggableWidgets/html-element-web/src/components/HTMLTag.tsx
index af563ff357..79f406bb4c 100644
--- a/packages/pluggableWidgets/html-element-web/src/components/HTMLTag.tsx
+++ b/packages/pluggableWidgets/html-element-web/src/components/HTMLTag.tsx
@@ -1,4 +1,5 @@
 import { createElement, HTMLAttributes, ReactElement, ReactNode } from "react";
+import { useSanitize } from "../utils/props-utils";
 
 interface HTMLTagProps {
     tagName: keyof JSX.IntrinsicElements;
@@ -8,10 +9,11 @@ interface HTMLTagProps {
 }
 
 export function HTMLTag(props: HTMLTagProps): ReactElement {
+    const sanitize = useSanitize();
     const Tag = props.tagName;
     const { unsafeHTML } = props;
     if (unsafeHTML !== undefined) {
-        return <Tag {...props.attributes} dangerouslySetInnerHTML={{ __html: unsafeHTML }} />;
+        return <Tag {...props.attributes} dangerouslySetInnerHTML={{ __html: sanitize(unsafeHTML) }} />;
     }
 
     return <Tag {...props.attributes}>{props.children}</Tag>;
diff --git a/packages/pluggableWidgets/html-element-web/src/components/__tests__/HTMLTag.spec.tsx b/packages/pluggableWidgets/html-element-web/src/components/__tests__/HTMLTag.spec.tsx
index dff3633fa4..f371db9801 100644
--- a/packages/pluggableWidgets/html-element-web/src/components/__tests__/HTMLTag.spec.tsx
+++ b/packages/pluggableWidgets/html-element-web/src/components/__tests__/HTMLTag.spec.tsx
@@ -37,6 +37,29 @@ describe("HTMLTag", () => {
         expect(asFragment()).toMatchSnapshot();
     });
 
+    it("with innerHTML apply html sanitizing", () => {
+        const checkSapshot = (html: string): void => {
+            expect(
+                render(
+                    <HTMLTag
+                        tagName="div"
+                        unsafeHTML={html}
+                        attributes={{
+                            className: "html-element-root my-class"
+                        }}
+                    >
+                        {undefined}
+                    </HTMLTag>
+                ).asFragment()
+            ).toMatchSnapshot();
+        };
+
+        checkSapshot("<p>Lorem ipsum <script>alert(1)</script></p>");
+        checkSapshot("<img src=x onerror=alert(1)>");
+        checkSapshot(`<b onmouseover=alert(‘XSS testing!‘)>ok</b>`);
+        checkSapshot("<a>123</a><option><style><img src=x onerror=alert(1)></style>");
+    });
+
     it("fires events", () => {
         const cbFn = jest.fn();
         const { getByTestId } = render(
diff --git a/packages/pluggableWidgets/html-element-web/src/components/__tests__/__snapshots__/HTMLTag.spec.tsx.snap b/packages/pluggableWidgets/html-element-web/src/components/__tests__/__snapshots__/HTMLTag.spec.tsx.snap
index 7fcab35549..a1e4c2e114 100644
--- a/packages/pluggableWidgets/html-element-web/src/components/__tests__/__snapshots__/HTMLTag.spec.tsx.snap
+++ b/packages/pluggableWidgets/html-element-web/src/components/__tests__/__snapshots__/HTMLTag.spec.tsx.snap
@@ -24,3 +24,52 @@ exports[`HTMLTag renders correctly with innerHTML 1`] = `
   </div>
 </DocumentFragment>
 `;
+
+exports[`HTMLTag with innerHTML apply html sanitizing 1`] = `
+<DocumentFragment>
+  <div
+    class="html-element-root my-class"
+  >
+    <p>
+      Lorem ipsum 
+    </p>
+  </div>
+</DocumentFragment>
+`;
+
+exports[`HTMLTag with innerHTML apply html sanitizing 2`] = `
+<DocumentFragment>
+  <div
+    class="html-element-root my-class"
+  >
+    <img
+      src="x"
+    />
+  </div>
+</DocumentFragment>
+`;
+
+exports[`HTMLTag with innerHTML apply html sanitizing 3`] = `
+<DocumentFragment>
+  <div
+    class="html-element-root my-class"
+  >
+    <b>
+      ok
+    </b>
+  </div>
+</DocumentFragment>
+`;
+
+exports[`HTMLTag with innerHTML apply html sanitizing 4`] = `
+<DocumentFragment>
+  <div
+    class="html-element-root my-class"
+  >
+    <a>
+      123
+    </a>
+    <option />
+  </div>
+</DocumentFragment>
+`;
diff --git a/packages/pluggableWidgets/html-element-web/src/utils/__tests__/props-utils.spec.ts b/packages/pluggableWidgets/html-element-web/src/utils/__tests__/props-utils.spec.ts
index 90af35c7f5..9593b05b55 100644
--- a/packages/pluggableWidgets/html-element-web/src/utils/__tests__/props-utils.spec.ts
+++ b/packages/pluggableWidgets/html-element-web/src/utils/__tests__/props-utils.spec.ts
@@ -1,4 +1,5 @@
-import { ObjectItem, ListActionValue, ActionValue, DynamicValue, ListExpressionValue, ListWidgetValue } from "mendix";
+import { ActionValue, DynamicValue, ListActionValue, ListExpressionValue, ListWidgetValue, ObjectItem } from "mendix";
+import { ReactNode } from "react";
 import {
     createAttributeResolver,
     createEventResolver,
@@ -6,9 +7,9 @@ import {
     prepareChildren,
     prepareEvents,
     prepareHtml,
-    prepareTag
+    prepareTag,
+    createSanitize
 } from "../props-utils";
-import { ReactNode } from "react";
 
 describe("props-utils", () => {
     describe("prepareTag", () => {
@@ -320,6 +321,23 @@ describe("props-utils", () => {
             });
         });
     });
+
+    describe("sanitizeHtml", () => {
+        it("apply html sanitizing", () => {
+            const sanitize = createSanitize();
+            expect(
+                sanitize(`<img src="nonexistent.png" onerror="alert('This restaurant got voted worst in town!');" />`)
+            ).toBe(`<img src="nonexistent.png">`);
+
+            expect(sanitize(`<div><script>destroyWebsite();</script></div>`)).toBe(`<div></div>`);
+
+            expect(sanitize(`<body onload=alert(‘something’)>`)).toBe("");
+
+            expect(sanitize(`<a href="javascript:alert('Don't laugh, this is not a joke!')">hello</a>`)).toBe(
+                `<a>hello</a>`
+            );
+        });
+    });
 });
 
 function createActionValue(): [ActionValue, jest.Mock] {
diff --git a/packages/pluggableWidgets/html-element-web/src/utils/props-utils.ts b/packages/pluggableWidgets/html-element-web/src/utils/props-utils.ts
index eb119529dd..ba3138c216 100644
--- a/packages/pluggableWidgets/html-element-web/src/utils/props-utils.ts
+++ b/packages/pluggableWidgets/html-element-web/src/utils/props-utils.ts
@@ -1,5 +1,6 @@
-import { CSSProperties, DOMAttributes, HTMLAttributes, ReactNode, SyntheticEvent } from "react";
+import { CSSProperties, DOMAttributes, HTMLAttributes, ReactNode, SyntheticEvent, useState } from "react";
 import { ObjectItem } from "mendix";
+import DOMPurify from "dompurify";
 
 import { AttributesType, EventsType, HTMLElementContainerProps, TagNameEnum } from "../../typings/HTMLElementProps";
 import { convertInlineCssToReactStyle } from "./style-utils";
@@ -139,3 +140,15 @@ export type VoidElement = typeof voidElements[number];
 export function isVoidElement(tag: unknown): tag is VoidElement {
     return voidElements.includes(tag as VoidElement);
 }
+
+type Sanitize = (html: string) => string;
+
+export function createSanitize(): Sanitize {
+    const purify = DOMPurify(window);
+    return html => purify.sanitize(html);
+}
+
+export function useSanitize(): ReturnType<typeof createSanitize> {
+    const [sanitize] = useState(createSanitize);
+    return sanitize;
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d25e0a9702..15935b9ac4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1105,15 +1105,19 @@ importers:
       '@testing-library/react-hooks': ^3.4.2
       '@testing-library/user-event': ^13.2.1
       '@types/big.js': ^6.0.2
+      '@types/dompurify': ^2.4.0
       '@types/react': <18.0.0
       '@types/react-dom': <18.0.0
       '@types/react-test-renderer': <18.0.0
       '@types/testing-library__jest-dom': ^5.14.1
       '@types/testing-library__react-hooks': ^3.4.0
+      dompurify: ^2.4.1
       mendix: ^9.19.55544
       react: ~17.0.2
       react-dom: ~17.0.2
       react-test-renderer: ~17.0.2
+    dependencies:
+      dompurify: 2.4.1
     devDependencies:
       '@mendix/pluggable-widgets-commons': link:../../shared/pluggable-widgets-commons
       '@mendix/pluggable-widgets-tools': 9.18.0_@types+react@17.0.52
@@ -1124,6 +1128,7 @@ importers:
       '@testing-library/react-hooks': 3.7.0_kcibn7jsej4njf6b4whwczgodu
       '@testing-library/user-event': 13.5.0_aaq3sbffpfe3jnxzm2zngsddei
       '@types/big.js': 6.1.6
+      '@types/dompurify': 2.4.0
       '@types/react': 17.0.52
       '@types/react-dom': 17.0.18
       '@types/react-test-renderer': 17.0.2
@@ -4786,6 +4791,12 @@ packages:
     resolution: {integrity: sha512-xX8QH80tLe9LBIiGKRl0ZMZ62WuFT5JXYBZGxFfdFbOvy2xfszKOkuYRRygM0NHuBhZwGXDJvJug2ID5DSsJxg==}
     dev: true
 
+  /@types/dompurify/2.4.0:
+    resolution: {integrity: sha512-IDBwO5IZhrKvHFUl+clZxgf3hn2b/lU6H1KaBShPkQyGJUQ0xwebezIPSuiyGwfz1UzJWQl4M7BDxtHtCCPlTg==}
+    dependencies:
+      '@types/trusted-types': 2.0.2
+    dev: true
+
   /@types/enzyme/3.10.12:
     resolution: {integrity: sha512-xryQlOEIe1TduDWAOphR0ihfebKFSWOXpIsk+70JskCfRfW+xALdnJ0r1ZOTo85F9Qsjk6vtlU7edTYHbls9tA==}
     dependencies:
@@ -5070,6 +5081,10 @@ packages:
       '@types/react-test-renderer': 17.0.2
     dev: true
 
+  /@types/trusted-types/2.0.2:
+    resolution: {integrity: sha512-F5DIZ36YVLE+PN+Zwws4kJogq47hNgX3Nx6WyDJ3kcplxyke3XIzB8uK5n/Lpm1HBsbGzd6nmGehL8cPekP+Tg==}
+    dev: true
+
   /@types/warning/3.0.0:
     resolution: {integrity: sha512-t/Tvs5qR47OLOr+4E9ckN8AmP2Tf16gWq+/qA4iUGS/OOyHVO8wv2vjJuX8SNOUTJyWb+2t7wJm6cXILFnOROA==}
     dev: false
@@ -7146,6 +7161,10 @@ packages:
       domelementtype: 2.3.0
     dev: true
 
+  /dompurify/2.4.1:
+    resolution: {integrity: sha512-ewwFzHzrrneRjxzmK6oVz/rZn9VWspGFRDb4/rRtIsM1n36t9AKma/ye8syCpcw+XJ25kOK/hOG7t1j2I2yBqA==}
+    dev: false
+
   /domutils/2.8.0:
     resolution: {integrity: sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==}
     dependencies: