diff --git a/src/backend/InvenTree/common/models.py b/src/backend/InvenTree/common/models.py
index 56ddf77bf1..e9e30d1f42 100644
--- a/src/backend/InvenTree/common/models.py
+++ b/src/backend/InvenTree/common/models.py
@@ -10,6 +10,7 @@ import hmac
 import json
 import math
 import os
+import re
 import uuid
 from collections import OrderedDict
 from datetime import timedelta, timezone
@@ -3130,6 +3131,12 @@ class Note(
                 },
             )
 
+            # nh3 does not recognise legacy IE-only CSS expression() calls as
+            # unsafe, so they survive style attribute filtering - strip them explicitly
+            self.content = re.sub(
+                r'expression\s*\(', '', self.content, flags=re.IGNORECASE
+            )
+
     def check_save(self):
         """Check if this note can be saved."""
         from InvenTree.models import InvenTreeNoteMixin