diff --git a/package-lock.json b/package-lock.json
index 41b282b8..d54c9cf8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,6 +11,7 @@
         "@vueuse/motion": "^3.0.3",
         "crypto-js": "^4.2.0",
         "date-fns": "^4.1.0",
+        "dompurify": "^3.3.1",
         "form-urlencoded": "^6.1.6",
         "ky": "^1.13.0",
         "pinia": "^3.0.3",
@@ -23,6 +24,7 @@
       "devDependencies": {
         "@eslint/js": "^9.38.0",
         "@rushstack/eslint-patch": "^1.14.0",
+        "@types/dompurify": "^3.0.5",
         "@types/node": "^24.9.1",
         "@typescript-eslint/eslint-plugin": "^8.46.2",
         "@typescript-eslint/parser": "^8.46.2",
@@ -1661,6 +1663,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/dompurify": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-3.0.5.tgz",
+      "integrity": "sha512-1Wg0g3BtQF7sSb27fJQAKck1HECM6zV1EB66j8JH9i3LCjYabJa0FSdiSgsD5K/RbrsR0SiraKacLB+T8ZVYAg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/trusted-types": "*"
+      }
+    },
     "node_modules/@types/estree": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
@@ -1685,6 +1697,13 @@
         "undici-types": "~7.16.0"
       }
     },
+    "node_modules/@types/trusted-types": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
+      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
+      "devOptional": true,
+      "license": "MIT"
+    },
     "node_modules/@types/web-bluetooth": {
       "version": "0.0.21",
       "resolved": "https://registry.npmjs.org/@types/web-bluetooth/-/web-bluetooth-0.0.21.tgz",
@@ -2748,6 +2767,15 @@
         "url": "https://github.com/fb55/domhandler?sponsor=1"
       }
     },
+    "node_modules/dompurify": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.1.tgz",
+      "integrity": "sha512-qkdCKzLNtrgPFP1Vo+98FRzJnBRGe4ffyCea9IwHB1fyxPOeNTHpLKYGd4Uk9xvNoH0ZoOjwZxNptyMwqrId1Q==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
+    },
     "node_modules/domutils": {
       "version": "3.2.2",
       "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz",
diff --git a/package.json b/package.json
index f84a0347..887f349e 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,7 @@
     "@vueuse/motion": "^3.0.3",
     "crypto-js": "^4.2.0",
     "date-fns": "^4.1.0",
+    "dompurify": "^3.3.1",
     "form-urlencoded": "^6.1.6",
     "ky": "^1.13.0",
     "pinia": "^3.0.3",
@@ -26,6 +27,7 @@
   "devDependencies": {
     "@eslint/js": "^9.38.0",
     "@rushstack/eslint-patch": "^1.14.0",
+    "@types/dompurify": "^3.0.5",
     "@types/node": "^24.9.1",
     "@typescript-eslint/eslint-plugin": "^8.46.2",
     "@typescript-eslint/parser": "^8.46.2",
diff --git a/src/components/artist/ArtistProfile.vue b/src/components/artist/ArtistProfile.vue
index ca829ce0..53cbe27e 100644
--- a/src/components/artist/ArtistProfile.vue
+++ b/src/components/artist/ArtistProfile.vue
@@ -11,6 +11,7 @@
 </template>
 
 <script lang="ts" setup>
+import DOMPurify from "dompurify";
 import { computed } from "vue";
 
 import { parseDiscogsMarkup } from "@/helpers/discogs";
@@ -18,6 +19,111 @@ import { useArtist } from "@/views/artist/ArtistStore";
 
 const artistStore = useArtist();
 
+const DISCOGS_BASE_URL = "https://www.discogs.com";
+const LINK_ATTRS = 'target="_blank" rel="noopener noreferrer" class="discogs-link"';
+
+/**
+ * Discogs entity types configuration
+ * Maps entity type letter to URL path and display text
+ */
+const DISCOGS_ENTITIES: Record<string, { path: string; searchType: string; text: string }> = {
+  a: { path: "artist", searchType: "artist", text: "artist" },
+  l: { path: "label", searchType: "label", text: "label" },
+  m: { path: "master", searchType: "master", text: "release" },
+  r: { path: "release", searchType: "release", text: "release" },
+};
+
+/**
+ * Text formatting tags configuration
+ */
+const TEXT_FORMATS: Array<{ pattern: RegExp; replacement: string }> = [
+  { pattern: /\[i\](.*?)\[\/i\]/gi, replacement: "<em>$1</em>" },
+  { pattern: /\[b\](.*?)\[\/b\]/gi, replacement: "<strong>$1</strong>" },
+  { pattern: /\[u\](.*?)\[\/u\]/gi, replacement: "<u>$1</u>" },
+];
+
+/**
+ * Create a Discogs link by ID
+ */
+function createDiscogsLinkById(type: string, id: string): string {
+  const entity = DISCOGS_ENTITIES[type.toLowerCase()];
+  if (!entity) return `[${type}${id}]`;
+  return `<a href="${DISCOGS_BASE_URL}/${entity.path}/${id}" ${LINK_ATTRS}>${entity.text}</a>`;
+}
+
+/**
+ * Create a Discogs search link by name
+ */
+function createDiscogsSearchLink(type: string, name: string): string {
+  const entity = DISCOGS_ENTITIES[type.toLowerCase()];
+  if (!entity) return `[${type}=${name}]`;
+  // Sanitize the display name to prevent XSS
+  const sanitizedName = DOMPurify.sanitize(name, { ALLOWED_TAGS: [] });
+  return `<a href="${DISCOGS_BASE_URL}/search/?q=${encodeURIComponent(name)}&type=${entity.searchType}" ${LINK_ATTRS}>${sanitizedName}</a>`;
+}
+
+/**
+ * Validate and sanitize a URL to prevent XSS attacks
+ */
+function sanitizeUrl(url: string): string {
+  // Remove any HTML entities that might have been escaped
+  const decodedUrl = url.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+
+  // Only allow http, https, and ftp protocols
+  try {
+    const urlObj = new URL(decodedUrl);
+    if (!["http:", "https:", "ftp:"].includes(urlObj.protocol)) {
+      return "#";
+    }
+    return urlObj.href;
+  } catch {
+    // If URL is invalid, return a safe placeholder
+    return "#";
+  }
+}
+
+/**
+ * Parse Discogs markup and convert to HTML
+ * Supported tags:
+ * - [i], [b], [u] -> text formatting
+ * - [a], [l], [r], [m] -> Discogs entity links (by ID or name)
+ * - [url] -> external links
+ */
+function parseDiscogsMarkup(text: string): string {
+  let result = text;
+
+  // Escape HTML to prevent XSS
+  result = result.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+
+  // Apply text formatting
+  for (const { pattern, replacement } of TEXT_FORMATS) {
+    result = result.replace(pattern, replacement);
+  }
+
+  // [x123456] or [x=123456] -> link to Discogs entity by ID
+  result = result.replace(/\[([almr])=?(\d+)\]/gi, (_, type, id) => createDiscogsLinkById(type, id));
+
+  // [x=Name] -> link to Discogs search by name (non-numeric)
+  result = result.replace(/\[([al])=([^\]]+)\]/gi, (_, type, name) => createDiscogsSearchLink(type, name));
+
+  // [url=http://...]text[/url] -> <a href="...">text</a>
+  result = result.replace(/\[url=(.*?)\](.*?)\[\/url\]/gi, (_, url, text) => {
+    const sanitizedUrl = sanitizeUrl(url);
+    // Sanitize the link text to prevent XSS
+    const sanitizedText = DOMPurify.sanitize(text, { ALLOWED_TAGS: [] });
+    return `<a href="${sanitizedUrl}" target="_blank" rel="noopener noreferrer">${sanitizedText}</a>`;
+  });
+
+  // [url]http://...[/url] -> <a href="...">...</a>
+  result = result.replace(/\[url\](.*?)\[\/url\]/gi, (_, url) => {
+    const sanitizedUrl = sanitizeUrl(url);
+    // Display the sanitized URL to prevent XSS
+    return `<a href="${sanitizedUrl}" target="_blank" rel="noopener noreferrer">${sanitizedUrl}</a>`;
+  });
+
+  return result;
+}
+
 /**
  * Extract the first sentence from text, but limit to max characters
  */