diff --git a/app/Template/analytic/layout.php b/app/Template/analytic/layout.php
index 7159094..11d5b9b 100644
--- a/app/Template/analytic/layout.php
+++ b/app/Template/analytic/layout.php
@@ -1,6 +1,6 @@
 <?php if ($is_ajax): ?>
     <div class="page-header">
-        <h2><?= $title ?></h2>
+        <h2><?= $this->text->e($title) ?></h2>
     </div>
 <?php else: ?>
     <?= $this->projectHeader->render($project, 'TaskListController', 'show') ?>
diff --git a/tests/units/Core/TemplateTest.php b/tests/units/Core/TemplateTest.php
index a065aa8..bdce8aa 100644
--- a/tests/units/Core/TemplateTest.php
+++ b/tests/units/Core/TemplateTest.php
@@ -3,6 +3,7 @@
 namespace KanboardTests\units\Core;
 
 use KanboardTests\units\Base;
+use Kanboard\Core\Http\Request;
 use Kanboard\Core\Security\Role;
 use Kanboard\Core\Template;
 
@@ -82,4 +83,26 @@ class TemplateTest extends Base
             $html
         );
     }
+
+    public function testAnalyticAjaxLayoutEscapesProjectNameInTitle()
+    {
+        $this->container['request'] = new Request($this->container, array(
+            'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest',
+        ));
+
+        $html = $this->container['helper']->layout->analytic('analytic/task_distribution', array(
+            'project' => array('id' => 1, 'name' => '<img src=x onerror=alert(document.domain)>'),
+            'metrics' => array(),
+            'title' => 'Task distribution',
+        ));
+
+        $this->assertStringNotContainsString(
+            '<img src=x onerror=alert(document.domain)>',
+            $html
+        );
+        $this->assertStringContainsString(
+            '<h2>&lt;img src=x onerror=alert(document.domain)&gt; &gt; Task distribution</h2>',
+            $html
+        );
+    }
 }