diff --git a/src/core/operations/ShowBase64Offsets.mjs b/src/core/operations/ShowBase64Offsets.mjs
index 37d8a6ce..0d91521a 100644
--- a/src/core/operations/ShowBase64Offsets.mjs
+++ b/src/core/operations/ShowBase64Offsets.mjs
@@ -95,7 +95,11 @@ class ShowBase64Offsets extends Operation {
         }
 
         if (!showVariable) {
-            offset0 = staticSection;
+            // staticSection is derived from the input via toBase64 with a
+            // user-controlled alphabet; without escaping, a crafted alphabet
+            // (e.g. one beginning "<script>...") could land directly in the
+            // HTML output (#2344). Escape before reuse on this branch.
+            offset0 = Utils.escapeHtml(staticSection);
         }
 
 
@@ -125,7 +129,7 @@ class ShowBase64Offsets extends Operation {
         }
 
         if (!showVariable) {
-            offset1 = staticSection;
+            offset1 = Utils.escapeHtml(staticSection);
         }
 
         // Highlight offset 2
@@ -154,7 +158,7 @@ class ShowBase64Offsets extends Operation {
         }
 
         if (!showVariable) {
-            offset2 = staticSection;
+            offset2 = Utils.escapeHtml(staticSection);
         }
 
         return (showVariable ? "Characters highlighted in <span class='hl5'>green</span> could change if the input is surrounded by more data." +
diff --git a/tests/operations/index.mjs b/tests/operations/index.mjs
index bb81d32e..46c83ecb 100644
--- a/tests/operations/index.mjs
+++ b/tests/operations/index.mjs
@@ -157,6 +157,7 @@ import "./tests/SeqUtils.mjs";
 import "./tests/SetDifference.mjs";
 import "./tests/SetIntersection.mjs";
 import "./tests/SetUnion.mjs";
+import "./tests/ShowBase64Offsets.mjs";
 import "./tests/Shuffle.mjs";
 import "./tests/SIGABA.mjs";
 import "./tests/SM2.mjs";
diff --git a/tests/operations/tests/ShowBase64Offsets.mjs b/tests/operations/tests/ShowBase64Offsets.mjs
new file mode 100644
index 00000000..f6764d42
--- /dev/null
+++ b/tests/operations/tests/ShowBase64Offsets.mjs
@@ -0,0 +1,57 @@
+/**
+ * ShowBase64Offsets tests
+ *
+ * @author SAY-5
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+import TestRegister from "../../lib/TestRegister.mjs";
+
+TestRegister.addTests([
+    {
+        // Regression test for #2344. With showVariable=false the
+        // staticSection (toBase64 output, alphabet-derived from a
+        // user-controlled argument) was inserted into the HTML output
+        // unescaped. A crafted alphabet whose Base64 image starts with
+        // `<script>...` could land directly in the rendered output and
+        // be eval'd by OutputWaiter.mjs. The fix runs the unescaped
+        // path through Utils.escapeHtml; this test pins that the raw
+        // `<script>` substring no longer appears verbatim and instead
+        // appears as the HTML-encoded `&lt;script&gt;`.
+        name: "Show Base64 offsets: HTML escapes static output (#2344)",
+        input: "ABCDEFGHIJKDGLMNAOBCDEFGHPPP",
+        // alphabet chosen so toBase64(input, alphabet) starts with
+        // "<script>"; recipe also passes showVariable=false so the
+        // staticSection is the bare offset0/1/2 reused as raw text.
+        expectedMatch: /&lt;script&gt;|<\/script>/,
+        recipeConfig: [
+            {
+                op: "Show Base64 offsets",
+                args: [
+                    "<script>ale(1)/.ABCDEFGHIJKLMNOPQRSTUVWXYZbdfghjkmnoquvwxyz023456",
+                    false,
+                    "Raw",
+                ],
+            },
+        ],
+    },
+    {
+        // Sanity: the showVariable=false output for a benign alphabet
+        // still produces something that contains the expected offsets
+        // header. This guards against the fix accidentally breaking
+        // the happy path.
+        name: "Show Base64 offsets: benign alphabet still renders Offset 0",
+        input: "Hello, world!",
+        expectedMatch: /Offset 0:/,
+        recipeConfig: [
+            {
+                op: "Show Base64 offsets",
+                args: [
+                    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
+                    false,
+                    "Raw",
+                ],
+            },
+        ],
+    },
+]);