diff --git a/src/core/operations/ParseEthernetFrame.mjs b/src/core/operations/ParseEthernetFrame.mjs
index 0be5e1a4..531273a1 100644
--- a/src/core/operations/ParseEthernetFrame.mjs
+++ b/src/core/operations/ParseEthernetFrame.mjs
@@ -92,7 +92,7 @@ class ParseEthernetFrame extends Operation {
         const packetData = input.slice(offset);
 
         if (outputFormat === "Packet data") {
-            return Utils.byteArrayToChars(packetData);
+            return Utils.escapeHtml(Utils.byteArrayToChars(packetData));
         } else if (outputFormat === "Packet data (hex)") {
             return toHex(packetData);
         } else if (outputFormat === "Text output") {
diff --git a/tests/operations/tests/ParseEthernetFrame.mjs b/tests/operations/tests/ParseEthernetFrame.mjs
index 063255ed..67954c76 100644
--- a/tests/operations/tests/ParseEthernetFrame.mjs
+++ b/tests/operations/tests/ParseEthernetFrame.mjs
@@ -41,5 +41,16 @@ TestRegister.addTests([
                 "args": ["Hex", "Text output"]
             }
         ]
+    },
+    {
+        name: "Parse Ethernet frame escapes packet data HTML",
+        input: "000000000000ffffffffffff08003c696d67207372633d78206f6e6572726f723d616c6572742831293e3c7363726970743e616c6572742832293c2f7363726970743e",
+        expectedOutput: "<img src=x onerror=alert(1)><script>alert(2)</script>",
+        recipeConfig: [
+            {
+                "op": "Parse Ethernet frame",
+                "args": ["Hex", "Packet data"]
+            }
+        ]
     }
 ]);