diff --git a/public/app/plugins/panel/table-old/renderer.ts b/public/app/plugins/panel/table-old/renderer.ts
index 6c3993c31f7..94cb88bae15 100644
--- a/public/app/plugins/panel/table-old/renderer.ts
+++ b/public/app/plugins/panel/table-old/renderer.ts
@@ -56,7 +56,7 @@ export class TableRenderer {
           column.style = style;
 
           if (style.alias) {
-            column.title = column.text.replace(regex, style.alias);
+            column.title = textUtil.escapeHtml(column.text.replace(regex, style.alias));
           }
 
           break;
@@ -300,7 +300,7 @@ export class TableRenderer {
       const cellLink = this.templateSrv.replace(column.style.linkUrl, scopedVars, encodeURIComponent);
       const sanitizedCellLink = textUtil.sanitizeUrl(cellLink);
 
-      const cellLinkTooltip = this.templateSrv.replace(column.style.linkTooltip, scopedVars);
+      const cellLinkTooltip = textUtil.escapeHtml(this.templateSrv.replace(column.style.linkTooltip, scopedVars));
       const cellTarget = column.style.linkTargetBlank ? '_blank' : '';
 
       cellClasses.push('table-panel-cell-link');