diff --git a/cms/templates/js/xblock-string-field-editor.underscore b/cms/templates/js/xblock-string-field-editor.underscore
index ced86dfa65..70ea7b2692 100644
--- a/cms/templates/js/xblock-string-field-editor.underscore
+++ b/cms/templates/js/xblock-string-field-editor.underscore
@@ -7,10 +7,10 @@
 <div class="xblock-string-field-editor incontext-editor-form">
   <form>
     <% var formLabel = gettext("Edit %(display_name)s (required)"); %>
-    <label><span class="sr"><%= interpolate(formLabel, {display_name: fieldDisplayName}, true) %></span>
-      <input type="text" value="<%= value %>" class="xblock-field-input incontext-editor-input" data-metadata-name="<%= fieldName %>">
+    <label><span class="sr"><%= interpolate(formLabel, {display_name: fieldDisplayName}, true) %></span> <% // xss-lint: disable=underscore-not-escaped %>
+      <input type="text" value="<%= value %>" class="xblock-field-input incontext-editor-input" data-metadata-name="<%- fieldName %>"> <% // xss-lint: disable=underscore-not-escaped %>
     </label>
-    <button class="sr action action-primary" name="submit" type="submit"><%= gettext("Save") %></button>
-    <button class="sr action action-secondary" name="cancel" type="button"><%= gettext("Cancel") %></button>
+    <button class="sr action action-primary" name="submit" type="submit"><%- gettext("Save") %></button>
+    <button class="sr action action-secondary" name="cancel" type="button"><%- gettext("Cancel") %></button>
   </form>
 </div>