diff --git a/app/javascript/elements/html_editor.js b/app/javascript/elements/html_editor.js
index 52c1c4c6..29a5f40e 100644
--- a/app/javascript/elements/html_editor.js
+++ b/app/javascript/elements/html_editor.js
@@ -111,7 +111,7 @@ const DROP_ATTRS = [
   'background', 'data', 'cite', 'ping', 'longdesc', 'manifest', 'profile'
 ]
 
-const SAFE_URL_REGEXP = /^(?:https?:\/\/|data:image\/|blob:|mailto:|tel:|\{)/i
+const SAFE_URL_REGEXP = /^(?:https?:\/\/|data:image\/|blob:|mailto:|tel:|\{|#)/i
 
 function isSafeAttr (name, value) {
   const lowerName = name.toLowerCase()
diff --git a/app/javascript/template_builder/dynamic_editor.js b/app/javascript/template_builder/dynamic_editor.js
index 580d47ad..cbde1587 100644
--- a/app/javascript/template_builder/dynamic_editor.js
+++ b/app/javascript/template_builder/dynamic_editor.js
@@ -103,7 +103,7 @@ const DROP_ATTRS = [
   'background', 'data', 'cite', 'ping', 'longdesc', 'manifest', 'profile'
 ]
 
-const SAFE_URL_REGEXP = /^(?:https?:\/\/|data:image\/|blob:|mailto:|tel:|\{)/i
+const SAFE_URL_REGEXP = /^(?:https?:\/\/|data:image\/|blob:|mailto:|tel:|\{|#)/i
 
 function isSafeAttr (name, value) {
   const lowerName = name.toLowerCase()