diff --git a/mod/scorm/datamodels/callback.js.php b/mod/scorm/datamodels/callback.js.php
index 520f22b03d3..27538674f6e 100644
--- a/mod/scorm/datamodels/callback.js.php
+++ b/mod/scorm/datamodels/callback.js.php
@@ -19,9 +19,27 @@
 
         success: function(o) {
             YUI().use('yui2-treeview', 'yui2-layout', function(Y) {
-                scorm_tree_node = Y.YUI2.widget.TreeView.getTree('scorm_tree');
+                // MDL-29159 The core version of getContentHtml doesn't escape text properly.
+                Y.YUI2.widget.TextNode.prototype.getContentHtml = function() {
+                    var sb = [];
+                    sb[sb.length] = this.href ? '<a' : '<span';
+                    sb[sb.length] = ' id="' + Y.YUI2.lang.escapeHTML(this.labelElId) + '"';
+                    sb[sb.length] = ' class="' + Y.YUI2.lang.escapeHTML(this.labelStyle) + '"';
+                    if (this.href) {
+                        sb[sb.length] = ' href="' + Y.YUI2.lang.escapeHTML(this.href) + '"';
+                        sb[sb.length] = ' target="' + Y.YUI2.lang.escapeHTML(this.target) + '"';
+                    }
+                    if (this.title) {
+                        sb[sb.length] = ' title="' + Y.YUI2.lang.escapeHTML(this.title) + '"';
+                    }
+                    sb[sb.length] = ' >';
+                    sb[sb.length] = this.label;
+                    sb[sb.length] = this.href?'</a>':'</span>';
+                    return sb.join("");
+                };
+
                 if (o.responseText !== undefined) {
-                    //alert('got a response: ' + o.responseText);
+                    var tree = new Y.YUI2.widget.TreeView('scorm_tree');
                     if (scorm_tree_node && o.responseText) {
                         var hnode = scorm_tree_node.getHighlightedNode();
                         var hidx = null;