diff --git a/src/core.js b/src/core.js
index 2a7bbb6..39bbfc2 100644
--- a/src/core.js
+++ b/src/core.js
@@ -539,8 +539,8 @@ const _confirmHTML = (opts) => {
   const confirmColor = opts.confirmColor || '#10b981';
   const cancelColor = opts.cancelColor || '#6b7280';
   return _btnRow(`
-    <button class="met-confirm-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${confirmColor};color:white;cursor:pointer;font-size:13px">${confirmText}</button>
-    <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${cancelText}</button>
+    <button class="met-confirm-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${confirmColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(confirmText)}</button>
+    <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(cancelText)}</button>
   `);
 };
 
@@ -557,12 +557,12 @@ const _promptHTML = (opts) => {
   return `
     <input type="${opts.inputType || 'text'}" 
            class="met-input" 
-           placeholder="${opts.placeholder || ''}"
-           value="${opts.defaultValue || ''}"
+           placeholder="${escapeHTML(opts.placeholder || '')}"
+           value="${escapeHTML(opts.defaultValue || '')}"
            style="width:100%;padding:8px 12px;border:1px solid rgba(0,0,0,0.1);border-radius:6px;font-size:13px;margin-top:8px;background:transparent;color:inherit;box-sizing:border-box">
     ${_btnRow(`
-      <button class="met-submit-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${submitColor};color:white;cursor:pointer;font-size:13px">${submitText}</button>
-      <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${cancelText}</button>
+      <button class="met-submit-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${submitColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(submitText)}</button>
+      <button class="met-cancel-btn" style="flex:1;padding:8px 16px;border:none;border-radius:6px;background:${cancelColor};color:white;cursor:pointer;font-size:13px">${escapeHTML(cancelText)}</button>
     `)}
   `;
 };