diff --git a/CHANGELOG b/CHANGELOG
index 144b34877148ec91144324f91ffdbc0676df7917..776f86c0e0768e6c7d3bc11c06591d7892d90a81 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -27,6 +27,7 @@ v 8.3.0 (unreleased)
   - Improve wording on project visibility levels (Zeger-Jan van de Weg)
   - Automatically select default clone protocol based on user preferences (Eirik Lygre)
   - Make Network page as sub tab of Commits
+  - Prevent possible XSS attack with award-emoji
 
 v 8.2.3
   - Fix application settings cache not expiring after changes (Stan Hu)
diff --git a/app/models/note.rb b/app/models/note.rb
index 98c29ddc4cd1d44f1c57ba7acdd769491e49e8a1..0f7efc2f2ab5888c307b869f9e6ec4219b30b139 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -350,7 +350,7 @@ class Note < ActiveRecord::Base
   end
 
   def editable?
-    !system?
+    !system? && !is_award
   end
 
   # Checks if note is an award added as a comment
diff --git a/spec/models/note_spec.rb b/spec/models/note_spec.rb
index cd3c868ecc57617647c447da37f5233df9930bf5..5b6f177ebb22759072b9888e594c69da17b8f047 100644
--- a/spec/models/note_spec.rb
+++ b/spec/models/note_spec.rb
@@ -142,4 +142,21 @@ describe Note, models: true do
       expect(Note.grouped_awards.first.last).to match_array(Note.all)
     end
   end
+
+  describe "editable?" do
+    it "returns true" do
+      note = build(:note)
+      expect(note.editable?).to be_truthy
+    end
+
+    it "returns false" do
+      note = build(:note, system: true)
+      expect(note.editable?).to be_falsy
+    end
+
+    it "returns false" do
+      note = build(:note, is_award: true, note: "smiley")
+      expect(note.editable?).to be_falsy
+    end
+  end
 end