Vulnerable to XSS/script injection

Simply setting a string to the following:
`alert('arf, arf. Gotcha!');`
and voila, your template will render it, script intact, resulting in the script running.

Needless to say this is incredibly dangerous.