diff --git a/core/includes/gettext.inc b/core/includes/gettext.inc
index a8498dc..176f061 100644
--- a/core/includes/gettext.inc
+++ b/core/includes/gettext.inc
@@ -354,9 +354,9 @@ function _locale_import_read_po($op, $file, $overwrite_options = NULL, $lang = N
  *   An optional line number argument.
  */
 function _locale_import_message($message, $file, $lineno = NULL) {
-  $vars = array('%filename' => $file->filename);
+  $vars = array('%filename' => check_plain($file->filename));
   if (isset($lineno)) {
-    $vars['%line'] = $lineno;
+    $vars['%line'] = check_plain($lineno);
   }
   $t = get_t();
   drupal_set_message($t($message, $vars), 'error');