This is going to be related to our security measures and ensuring there is no chance for script injection.
I am sure there is a straight forward fix, but surface area is quite big and we would need very careful testing to ensure that an XSS is not introduced with the fix.
Going to put pr-welcome on this for now, but whoever takes this please be extra careful to prove your change does not introduce an XSS vector.