diff --git a/tools/console.c b/tools/console.c
index ca226c3356..34fde05eb7 100644
--- a/tools/console.c
+++ b/tools/console.c
@@ -34,6 +34,7 @@
 # include <errno.h>
 # include <unistd.h>
 # include <signal.h>
+# include <c-ctype.h>
 
 # include "internal.h"
 # include "console.h"
@@ -292,7 +293,7 @@ static char
 vshGetEscapeChar(const char *s)
 {
     if (*s == '^')
-        return CONTROL(s[1]);
+        return CONTROL(c_toupper(s[1]));
 
     return *s;
 }
diff --git a/tools/virsh.c b/tools/virsh.c
index 1ed2ddaae6..cfdd040b5e 100644
--- a/tools/virsh.c
+++ b/tools/virsh.c
@@ -19879,6 +19879,16 @@ vshShowVersion(vshControl *ctl ATTRIBUTE_UNUSED)
     vshPrint(ctl, "\n");
 }
 
+static bool
+vshAllowedEscapeChar(char c)
+{
+    /* Allowed escape characters:
+     * a-z A-Z @ [ \ ] ^ _
+     */
+    return ('a' <= c && c <= 'z') ||
+        ('@' <= c && c <= '_');
+}
+
 /*
  * argv[]:  virsh [options] [command]
  *
@@ -19942,7 +19952,8 @@ vshParseArgv(vshControl *ctl, int argc, char **argv)
         case 'e':
             len = strlen(optarg);
 
-            if ((len == 2 && *optarg == '^') ||
+            if ((len == 2 && *optarg == '^' &&
+                 vshAllowedEscapeChar(optarg[1])) ||
                 (len == 1 && *optarg != '^')) {
                 ctl->escapeChar = optarg;
             } else {
diff --git a/tools/virsh.pod b/tools/virsh.pod
index d4971a32cb..a60e66770a 100644
--- a/tools/virsh.pod
+++ b/tools/virsh.pod
@@ -95,7 +95,8 @@ Output elapsed time information for each command.
 =item B<-e>, B<--escape> I<string>
 
 Set alternative escape sequence for I<console> command. By default,
-telnet's B<^]> is used.
+telnet's B<^]> is used. Allowed characters when using hat notation are:
+alphabetic character, @, [, ], \, ^, _.
 
 =back