diff --git a/packages/utils/parse.ts b/packages/utils/parse.ts
index abf99a75c1..5243824b24 100644
--- a/packages/utils/parse.ts
+++ b/packages/utils/parse.ts
@@ -90,7 +90,7 @@ export const configuredXss = new FilterXSS({
 			!value.startsWith('data:')
 		) {
 			try {
-				const url = new URL(value)
+				const url = new URL(value.replaceAll('&', '&'))
 
 				if (url.hostname.includes('wsrv.nl')) {
 					url.searchParams.delete('errorredirect')
@@ -124,16 +124,10 @@ export const configuredXss = new FilterXSS({
 					!allowedHostnames.includes(url.hostname) &&
 					!allowedHostnameSuffixes.some((suffix) => url.hostname.endsWith(suffix))
 				) {
-					return safeAttrValue(
-						tag,
-						name,
-						`https://wsrv.nl/?url=${encodeURIComponent(
-							url.toString().replaceAll('&', '&'),
-						)}&n=-1`,
-						cssFilter,
-					)
+					const proxiedUrl = `https://wsrv.nl/?url=${encodeURIComponent(url.toString())}&n=-1`
+					return safeAttrValue(tag, name, proxiedUrl.replaceAll('&', '&'), cssFilter)
 				}
-				return safeAttrValue(tag, name, url.toString(), cssFilter)
+				return safeAttrValue(tag, name, url.toString().replaceAll('&', '&'), cssFilter)
 			} catch {
 				/* empty */
 			}