diff --git a/lib/redmine/helpers/diff.rb b/lib/redmine/helpers/diff.rb
index 785ff38..7a28ad7 100644
--- a/lib/redmine/helpers/diff.rb
+++ b/lib/redmine/helpers/diff.rb
@@ -53,7 +53,7 @@ module Redmine
             else
               del_at = pos unless del_at
               deleted << ' ' unless deleted.empty?
-              deleted << h(change[2])
+              deleted << change[2]
               words_del  += 1
             end
           end
@@ -62,13 +62,14 @@ module Redmine
             words[add_to] = words[add_to] + '</span>'.html_safe
           end
           if del_at
-            words.insert del_at - del_off + dels + words_add, '<span class="diff_out">'.html_safe + deleted + '</span>'.html_safe
+            # deleted is not safe html at this point
+            words.insert del_at - del_off + dels + words_add, '<span class="diff_out">'.html_safe + h(deleted) + '</span>'.html_safe
             dels += 1
             del_off += words_del
             words_del = 0
           end
         end
-        words.join(' ').html_safe
+        safe_join(words, ' ')
       end
     end
   end
diff --git a/test/unit/lib/redmine/helpers/diff_test.rb b/test/unit/lib/redmine/helpers/diff_test.rb
index a5f7afe..e2006d7 100644
--- a/test/unit/lib/redmine/helpers/diff_test.rb
+++ b/test/unit/lib/redmine/helpers/diff_test.rb
@@ -22,4 +22,16 @@ class DiffTest < ActiveSupport::TestCase
     diff = Redmine::Helpers::Diff.new("foo", "bar")
     assert_not_nil diff
   end
+
+  def test_dont_double_escape
+    # 3 cases to test in the before: first word, last word, everything inbetween
+    before = "<stuff> with html & special chars</danger>"
+    # all words in after are treated equal
+    after  = "other stuff <script>alert('foo');</alert>"
+
+    computed_diff = Redmine::Helpers::Diff.new(before, after).to_html
+    expected_diff = '<span class="diff_in">&lt;stuff&gt; with html &amp; special chars&lt;/danger&gt;</span> <span class="diff_out">other stuff &lt;script&gt;alert(&#39;foo&#39;);&lt;/alert&gt;</span>'
+
+    assert_equal computed_diff, expected_diff
+  end
 end