diff --git a/lib/pretty_text.rb b/lib/pretty_text.rb
index ec0936e6e43..6f819324199 100644
--- a/lib/pretty_text.rb
+++ b/lib/pretty_text.rb
@@ -82,6 +82,8 @@ module PrettyText
     ctx_load(ctx, "#{Rails.root}/app/assets/javascripts/discourse-loader.js")
     ctx_load(ctx, "#{Rails.root}/app/assets/javascripts/handlebars-shim.js")
     ctx_load(ctx, "vendor/assets/javascripts/lodash.js")
+    ctx_load(ctx, "vendor/assets/javascripts/xss.min.js")
+    ctx.load("#{Rails.root}/lib/pretty_text/vendor-shims.js")
     ctx_load_manifest(ctx, "pretty-text-bundle.js")
     ctx_load_manifest(ctx, "markdown-it-bundle.js")
     root_path = "#{Rails.root}/app/assets/javascripts/"
diff --git a/lib/pretty_text/shims.js b/lib/pretty_text/shims.js
index 4a01e947043..4c9de85dfc8 100644
--- a/lib/pretty_text/shims.js
+++ b/lib/pretty_text/shims.js
@@ -9,16 +9,16 @@ __resetTranslationTree = require("pretty-text/engines/discourse-markdown/emoji")
 I18n = {
   t(a, b) {
     return __helpers.t(a, b);
-  }
+  },
 };
 
-define("I18n", ["exports"], function(exports) {
+define("I18n", ["exports"], function (exports) {
   exports.default = I18n;
 });
 
 // Formatting doesn't currently need any helper context
-define("discourse-common/lib/helpers", ["exports"], function(exports) {
-  exports.helperContext = function() {
+define("discourse-common/lib/helpers", ["exports"], function (exports) {
+  exports.helperContext = function () {
     return {};
   };
 });
@@ -27,10 +27,10 @@ __utils = require("discourse/lib/utilities");
 
 __emojiUnicodeReplacer = null;
 
-__setUnicode = function(replacements) {
+__setUnicode = function (replacements) {
   let unicodeRegexp = new RegExp(__buildReplacementsList(replacements), "g");
 
-  __emojiUnicodeReplacer = function(text) {
+  __emojiUnicodeReplacer = function (text) {
     unicodeRegexp.lastIndex = 0;
     let m;
     while ((m = unicodeRegexp.exec(text)) !== null) {
diff --git a/lib/pretty_text/vendor-shims.js b/lib/pretty_text/vendor-shims.js
new file mode 100644
index 00000000000..cd0518870f3
--- /dev/null
+++ b/lib/pretty_text/vendor-shims.js
@@ -0,0 +1,3 @@
+define("xss", ["exports"], function (__exports__) {
+  __exports__.default = window.filterXSS;
+});