diff --git a/package.json b/package.json
index 78b4e6818c..8c09610fd2 100644
--- a/package.json
+++ b/package.json
@@ -124,6 +124,7 @@
     "rxjs": "^5.4.3",
     "tether": "^1.4.0",
     "tether-drop": "https://github.com/torkelo/drop",
-    "tinycolor2": "^1.4.1"
+    "tinycolor2": "^1.4.1",
+    "xss": "1.0.6"
   }
 }
diff --git a/public/app/core/utils/text.ts b/public/app/core/utils/text.ts
index e69de29bb2..b68547fc96 100644
--- a/public/app/core/utils/text.ts
+++ b/public/app/core/utils/text.ts
@@ -0,0 +1,34 @@
+import xss from 'xss';
+
+const XSSWL = Object.keys(xss.whiteList).reduce((acc, element) => {
+  acc[element] = xss.whiteList[element].concat(['class', 'style']);
+  return acc;
+}, {});
+
+const sanitizeXSS = new xss.FilterXSS({
+  whiteList: XSSWL,
+});
+
+/**
+ * Returns string safe from XSS attacks.
+ *
+ * Even though we allow the style-attribute, there's still default filtering applied to it
+ * Info: https://github.com/leizongmin/js-xss#customize-css-filter
+ * Whitelist: https://github.com/leizongmin/js-css-filter/blob/master/lib/default.js
+ */
+export function sanitize(unsanitizedString: string): string {
+  try {
+    return sanitizeXSS.process(unsanitizedString);
+  } catch (error) {
+    console.log('String could not be sanitized', unsanitizedString);
+    return unsanitizedString;
+  }
+}
+
+export function escapeHtml(str: string): string {
+  return String(str)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
diff --git a/public/app/features/panel/panel_ctrl.ts b/public/app/features/panel/panel_ctrl.ts
index 34574bdb47..5856c8ef05 100644
--- a/public/app/features/panel/panel_ctrl.ts
+++ b/public/app/features/panel/panel_ctrl.ts
@@ -2,6 +2,7 @@ import config from 'app/core/config';
 import _ from 'lodash';
 import $ from 'jquery';
 import {profiler} from 'app/core/profiler';
+import { escapeHtml } from 'app/core/utils/text';
 import Remarkable from 'remarkable';
 
 const TITLE_HEIGHT = 25;
@@ -258,13 +259,15 @@ export class PanelCtrl {
     var interpolatedMarkdown = templateSrv.replace(markdown, this.panel.scopedVars);
     var html = '<div class="markdown-html">';
 
-    html += new Remarkable().render(interpolatedMarkdown);
+    const md = new Remarkable().render(interpolatedMarkdown);
+    html += config.disableSanitizeHtml ? md : sanitize(md);
 
     if (this.panel.links && this.panel.links.length > 0) {
       html += '<ul>';
       for (let link of this.panel.links) {
         var info = linkSrv.getPanelLinkAnchorInfo(link, this.panel.scopedVars);
-        html += '<li><a class="panel-menu-link" href="' + info.href + '" target="' + info.target + '">' + info.title + '</a></li>';
+        html += '<li><a class="panel-menu-link" href="' + escapeHtml(info.href);
+        html += '" target="' + escapeHtml(info.target) + '">' + escapeHtml(info.title) + '</a></li>';
       }
       html += '</ul>';
     }
diff --git a/public/app/plugins/panel/text/module.ts b/public/app/plugins/panel/text/module.ts
index 5f453aea15..cf73f3cffd 100644
--- a/public/app/plugins/panel/text/module.ts
+++ b/public/app/plugins/panel/text/module.ts
@@ -1,6 +1,7 @@
 ///<reference path="../../../headers/common.d.ts" />
 
 import _ from 'lodash';
+import { escapeHtml } from 'app/core/utils/text';
 import {PanelCtrl} from 'app/plugins/sdk';
 
 export class TextPanelCtrl extends PanelCtrl {
@@ -48,12 +49,8 @@ export class TextPanelCtrl extends PanelCtrl {
   }
 
   renderText(content) {
-    content = content
-    .replace(/&/g, '&amp;')
-    .replace(/>/g, '&gt;')
-    .replace(/</g, '&lt;')
-    .replace(/\n/g, '<br/>');
-    this.updateContent(content);
+    const safeContent = escapeHtml(content).replace(/\n/g, '<br/>');
+    this.updateContent(safeContent);
   }
 
   renderMarkdown(content) {
diff --git a/public/sass/base/_fonts.scss b/public/sass/base/_fonts.scss
index fb360ba587..250521e1d6 100644
--- a/public/sass/base/_fonts.scss
+++ b/public/sass/base/_fonts.scss
@@ -1,5 +1,5 @@
-@import "base/font_awesome";
-@import "base/grafana_icons";
+@import "font_awesome";
+@import "grafana_icons";
 
 /* Open sans fonts*/
