XSS fix for "next up"