diff --git a/src/PhpSpreadsheet/Writer/Html.php b/src/PhpSpreadsheet/Writer/Html.php
index ac14e3152..01733205e 100644
--- a/src/PhpSpreadsheet/Writer/Html.php
+++ b/src/PhpSpreadsheet/Writer/Html.php
@@ -1039,7 +1039,7 @@ class Html extends BaseWriter
         }
 
         $css['color'] = '#' . $font->getColor()->getRGB();
-        $css['font-family'] = '\'' . $font->getName() . '\'';
+        $css['font-family'] = '\'' . htmlspecialchars((string) $font->getName(), ENT_QUOTES) . '\'';
         $css['font-size'] = $font->getSize() . 'pt';
 
         return $css;
diff --git a/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php b/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php
index 28716b8ad..1d8bcbb4b 100644
--- a/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php
+++ b/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php
@@ -59,4 +59,21 @@ class XssVulnerabilityTest extends Functional\AbstractFunctional
         self::assertStringContainsString($expected, $verify);
         $spreadsheet->disconnectWorksheets();
     }
+
+    public function testXssInFontName(): void
+    {
+        $spreadsheet = new Spreadsheet();
+        $sheet = $spreadsheet->getActiveSheet();
+        $sheet->getCell('A1')->setValue('here');
+        $used = 'Calibri</style><script type="text/javascript">alert("hello");</script><style type="text/css">';
+        $expected = "font-family:'Calibri&lt;/style&gt;&lt;script type=&quot;text/javascript&quot;&gt;alert(&quot;hello&quot;);&lt;/script&gt;&lt;style type=&quot;text/css&quot;&gt;'";
+        $sheet->getStyle('A1')->getFont()->setName($used);
+
+        $writer = new Html($spreadsheet);
+        $verify = $writer->generateHtmlAll();
+        // Ensure that executable js has been stripped
+        self::assertStringNotContainsString($expected, $used);
+        self::assertStringContainsString($expected, $verify);
+        $spreadsheet->disconnectWorksheets();
+    }
 }