diff --git a/common/djangoapps/pipeline_mako/templates/mako/inline_js.html b/common/djangoapps/pipeline_mako/templates/mako/inline_js.html
index 1a231e220b..a9fbafc07c 100644
--- a/common/djangoapps/pipeline_mako/templates/mako/inline_js.html
+++ b/common/djangoapps/pipeline_mako/templates/mako/inline_js.html
@@ -1,9 +1,13 @@
+<%page expression_filter="h"/>
+<%! from openedx.core.djangolib.js_utils import dump_js_escaped_json %>
 <script \
-% if async:
+% if context.get('async', default=None):
 async \
 % endif
-if defer:
+% if defer:
 defer \
+% endif
 type="text/javascript" charset="utf-8">
-    ${source | safe}
+    ## xss-lint: disable=mako-invalid-html-filter
+    ${source | n, dump_js_escaped_json}
 </script>
diff --git a/common/djangoapps/pipeline_mako/templates/mako/js.html b/common/djangoapps/pipeline_mako/templates/mako/js.html
index ffc9355675..86c706f9ce 100644
--- a/common/djangoapps/pipeline_mako/templates/mako/js.html
+++ b/common/djangoapps/pipeline_mako/templates/mako/js.html
@@ -1,5 +1,6 @@
+<%page expression_filter="h"/>
 <script \
-% if async:
+% if context.get('async', default=None):
 async \
 % endif
 % if defer: