diff --git a/cms/static/js/index.js b/cms/static/js/index.js
index 70def59cad..58f230e6f2 100644
--- a/cms/static/js/index.js
+++ b/cms/static/js/index.js
@@ -61,8 +61,9 @@ define(['domReady', 'jquery', 'underscore', 'js/utils/cancel_on_escape', 'js/vie
 
             analytics.track('Created a Course', course_info);
             CreateCourseUtils.create(course_info, function(errorMessage) {
+                var msg = edx.HtmlUtils.joinHtml(edx.HtmlUtils.HTML('<p>'), errorMessage, edx.HtmlUtils.HTML('</p>'));
                 $('.create-course .wrap-error').addClass('is-shown');
-                $('#course_creation_error').html('<p>' + errorMessage + '</p>');
+                edx.HtmlUtils.setHtml($('#course_creation_error'), msg);
                 $('.new-course-save').addClass('is-disabled').attr('aria-disabled', true);
             });
         };
@@ -136,8 +137,9 @@ define(['domReady', 'jquery', 'underscore', 'js/utils/cancel_on_escape', 'js/vie
 
             analytics.track('Created a Library', lib_info);
             CreateLibraryUtils.create(lib_info, function(errorMessage) {
+                var msg = edx.HtmlUtils.joinHtml(edx.HtmlUtils.HTML('<p>'), errorMessage, edx.HtmlUtils.HTML('</p>'));
                 $('.create-library .wrap-error').addClass('is-shown');
-                $('#library_creation_error').html('<p>' + errorMessage + '</p>');
+                edx.HtmlUtils.setHtml($('#library_creation_error'), msg);
                 $('.new-library-save').addClass('is-disabled').attr('aria-disabled', true);
             });
         };
diff --git a/cms/static/js/models/uploads.js b/cms/static/js/models/uploads.js
index be12dbfb1a..8db4129d9e 100644
--- a/cms/static/js/models/uploads.js
+++ b/cms/static/js/models/uploads.js
@@ -14,7 +14,7 @@ define(['backbone', 'underscore', 'gettext'], function(Backbone, _, gettext) {
         validate: function(attrs, options) {
             if (attrs.selectedFile && !this.checkTypeValidity(attrs.selectedFile)) {
                 return {
-                    message: _.template(gettext('Only <%= fileTypes %> files can be uploaded. Please select a file ending in <%= fileExtensions %> to upload.'))(  // eslint-disable-line max-len
+                    message: _.template(gettext('Only <%- fileTypes %> files can be uploaded. Please select a file ending in <%- (fileExtensions) %> to upload.'))(  // eslint-disable-line max-len
                     this.formatValidTypes()
                 ),
                     attributes: {selectedFile: true}
@@ -62,7 +62,7 @@ define(['backbone', 'underscore', 'gettext'], function(Backbone, _, gettext) {
             }
             var or = gettext('or');
             var formatTypes = function(types) {
-                return _.template('<%= initial %> <%= or %> <%= last %>')({
+                return _.template('<%- initial %> <%- or %> <%- last %>')({
                     initial: _.initial(types).join(', '),
                     or: or,
                     last: _.last(types)