diff --git a/gulpfile.js b/gulpfile.js
index ad347250f0..2dfd361814 100644
--- a/gulpfile.js
+++ b/gulpfile.js
@@ -72,6 +72,7 @@ const common = {
         'node_modules/react-dom/umd/react-dom.production.min.js',
         'node_modules/react-dom/umd/react-dom.development.js',
         'node_modules/prop-types/prop-types.min.js',
+        'node_modules/dompurify/dist/purify.js',
       ]).pipe(gulp.dest(path.join(outputPath, 'js'))),
       () => gulp.src([
         'node_modules/@tabler/icons-react/dist/umd/tabler-icons-react.min.js',
diff --git a/resources/marketplace.html b/resources/marketplace.html
index 8aec5813d2..22b8cdea98 100644
--- a/resources/marketplace.html
+++ b/resources/marketplace.html
@@ -69,6 +69,7 @@
 <body>
 <div id="app"></div>
 <script src="./js/marked.min.js"></script>
+<script src="./js/purify.js"></script>
 <script>
   ;(async function () {
     const app = document.getElementById('app')
@@ -131,7 +132,7 @@
       }
 
       content = marked.parse(content).replace('src="./', `src="${fixLink('')}`)
-      setContent(content)
+      setContent(DOMPurify.sanitize(content))
     }
 
     // load default
diff --git a/src/main/frontend/components/plugins.cljs b/src/main/frontend/components/plugins.cljs
index 80e1add4f3..72481f41a7 100644
--- a/src/main/frontend/components/plugins.cljs
+++ b/src/main/frontend/components/plugins.cljs
@@ -202,7 +202,7 @@
 
 (rum/defc remote-readme-display
   [{:keys [repo]} _content]
-  (let [src (str (if (string/includes? js/location.href "logseq")
+  (let [src (str (if (string/includes? js/location.host "logseq")
                    "./static/" "./") "marketplace.html?repo=" repo)]
     [:iframe.lsp-frame-readme {:src src}]))
 
