diff --git a/src/lib/util/state.ts b/src/lib/util/state.ts
index 79f8355a..5274e513 100644
--- a/src/lib/util/state.ts
+++ b/src/lib/util/state.ts
@@ -187,6 +187,12 @@ function getUnsafePaths(object: object, unsafeKeys: string[], path: string[] = [
     }
     if (typeof value === 'object' && value !== null) {
       unsafePaths.push(...getUnsafePaths(value as object, unsafeKeys, currentPath));
+    } else if (
+      typeof value === 'string' &&
+      // XSS prevention checks -- See mermaid `sanitize` function for reference.
+      (value.includes('<') || value.includes('>') || value.includes('url(data:'))
+    ) {
+      unsafePaths.push(currentPath);
     }
   });
   return unsafePaths;
diff --git a/tests/loadSite.spec.ts b/tests/loadSite.spec.ts
index e0d8b0a7..f94b03f5 100644
--- a/tests/loadSite.spec.ts
+++ b/tests/loadSite.spec.ts
@@ -84,7 +84,10 @@ test.describe('Site Loads', () => {
           JSON.stringify({
             someOtherSetting: 'Test value',
             securityLevel: 'loose',
-            secure: []
+            secure: [],
+            themeVariables: {
+              nodeBorder: '</style></svg><script>alert("XSS")</script>'
+            }
           })
         )}`
       }).toString()}`
@@ -96,7 +99,8 @@ test.describe('Site Loads', () => {
     const parsedStore = JSON.parse(codeStore) as State;
     const parsedConfig = JSON.parse(parsedStore.mermaid) as Record<string, unknown>;
     expect(parsedConfig).toEqual({
-      someOtherSetting: 'Test value'
+      someOtherSetting: 'Test value',
+      themeVariables: {}
     });
     // should scrub unsafe securityLevel but keep other settings
     expect(parsedConfig.securityLevel).toBeUndefined();