diff --git a/openedx/core/djangoapps/cors_csrf/templates/cors_csrf/xdomain_proxy.html b/openedx/core/djangoapps/cors_csrf/templates/cors_csrf/xdomain_proxy.html
index 66d1a4a31a..7c74321daa 100644
--- a/openedx/core/djangoapps/cors_csrf/templates/cors_csrf/xdomain_proxy.html
+++ b/openedx/core/djangoapps/cors_csrf/templates/cors_csrf/xdomain_proxy.html
@@ -1,5 +1,12 @@
-<%namespace name='static' file='../static_content.html'/>
+<%page expression_filter="h"/>
 
+<%namespace name='static' file='../static_content.html'/>
+<%!
+from openedx.core.djangolib.js_utils import (
+    dump_js_escaped_json
+)
+%>
+<%! import json %>
 <!DOCTYPE HTML>
 <script src="${static.url('js/vendor/xdomain.min.js')}"></script>
-<script>xdomain.masters(${xdomain_masters});</script>
+<script>xdomain.masters(${json.loads(xdomain_masters) | n, dump_js_escaped_json});</script>
