From 36dfce57d92328e7c14c759ae1eb519b7c066418 Mon Sep 17 00:00:00 2001
From: Rylan <rylanbot@qq.com>
Date: Tue, 3 Feb 2026 18:22:39 +0800
Subject: [PATCH] fix(Text): text is rendered as HTML tags when `ellipsis` is
 enabled

---
 packages/components/typography/ellipsis/Truncate.tsx | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/packages/components/typography/ellipsis/Truncate.tsx b/packages/components/typography/ellipsis/Truncate.tsx
index e7c14df953..b207d25399 100644
--- a/packages/components/typography/ellipsis/Truncate.tsx
+++ b/packages/components/typography/ellipsis/Truncate.tsx
@@ -146,12 +146,21 @@ export default class Truncate extends React.Component<TruncateProps, TruncateSta
     return this.createMarkup(content) as unknown as string;
   };
 
+  escapeHtml = (html: string) =>
+    html
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#39;');
+
   // Shim innerText to consistently break lines at <br/> but not at \n
   innerText = (node: HTMLElement) => {
     const div = document.createElement('div');
     const contentKey = 'innerText' in window.HTMLElement.prototype ? 'innerText' : 'textContent';
 
-    const content = node.innerHTML.replace(/\r\n|\r|\n/g, ' ');
+    const escapedHtml = this.escapeHtml(node.innerHTML);
+    const content = escapedHtml.replace(/\r\n|\r|\n/g, ' ');
     div.innerHTML = this.extractReplaceLinksKeys(content);
 
     let text = div[contentKey];