diff --git a/tools/warn.py b/tools/warn.py
index 22ac872..5f796f5 100755
--- a/tools/warn.py
+++ b/tools/warn.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 #
 # Copyright (C) 2019 The Android Open Source Project
 #
@@ -28,7 +28,7 @@
 
 def main():
   os.environ['PYTHONPATH'] = os.path.dirname(os.path.abspath(__file__))
-  subprocess.check_call(['/usr/bin/python', '-m', 'warn.warn'] + sys.argv[1:])
+  subprocess.check_call(['/usr/bin/python3', '-m', 'warn.warn'] + sys.argv[1:])
 
 
 if __name__ == '__main__':
diff --git a/tools/warn/html_writer.py b/tools/warn/html_writer.py
index 026a6d0..be71b55 100644
--- a/tools/warn/html_writer.py
+++ b/tools/warn/html_writer.py
@@ -52,8 +52,8 @@
 #   emit_js_data():
 
 from __future__ import print_function
-import cgi
 import csv
+import html
 import sys
 
 # pylint:disable=relative-beyond-top-level
@@ -582,10 +582,7 @@
 def emit_const_html_string_array(name, array, writer):
   writer('const ' + name + ' = [')
   for s in array:
-    # Not using html.escape yet, to work for both python 2 and 3,
-    # until all users switch to python 3.
-    # pylint:disable=deprecated-method
-    writer('"' + cgi.escape(strip_escape_string(s)) + '",')
+    writer('"' + html.escape(strip_escape_string(s)) + '",')
   writer('];')
 
 
diff --git a/tools/warn/warn.py b/tools/warn/warn.py
index 56e8787..cb5daec 100755
--- a/tools/warn/warn.py
+++ b/tools/warn/warn.py
@@ -1,4 +1,4 @@
-#!/usr/bin/python
+#!/usr/bin/env python3
 #
 # Copyright (C) 2019 The Android Open Source Project
 #