diff --git a/src/app/(frontend)/memos/[slug]/page.tsx b/src/app/(frontend)/memos/[slug]/page.tsx
index e86cae7..946f3b3 100644
--- a/src/app/(frontend)/memos/[slug]/page.tsx
+++ b/src/app/(frontend)/memos/[slug]/page.tsx
@@ -12,6 +12,18 @@ function getMediaUrl(media: unknown): string {
 	return m.url || "/images/Logo-Box.png";
 }
 
+/**
+ * Remove every <script> element from CMS HTML.
+ * Migrated Webflow bodies are server-rendered verbatim, so any inline script
+ * runs when the browser parses the page. Editors must not be able to run
+ * unchecked JavaScript through memo content.
+ */
+function stripScripts(html: string): string {
+	return html
+		.replace(/<script\b[^>]*>[\s\S]*?<\/script\s*>/gi, "")
+		.replace(/<script\b[^>]*\/?>/gi, "");
+}
+
 /**
  * Extract raw HTML from a Lexical richtext field that was migrated from Webflow.
  * The migration stored the entire HTML string as a single Lexical text node.
@@ -36,7 +48,7 @@ function extractHtmlFromLexical(data: unknown): string | null {
 	const textNode = textChildren[0];
 	if (textNode.type !== "text") return null;
 	const text = textNode.text as string;
-	if (/<[a-z][\s\S]*>/i.test(text)) return text;
+	if (/<[a-z][\s\S]*>/i.test(text)) return stripScripts(text);
 	return null;
 }