low severityPostmark Templates API (sendEmailWithTemplate)

Dynamic variables containing HTML tags (e.g., {{body}} where body = "Hi...<br><br>Welcome") display raw tags like "<br><br>" as plain text in the email instead of rendering line breaks or HTML formatting.

Root cause

Postmark's Mustachio templating engine automatically HTML-escapes variables using {{variable}} syntax by default to prevent XSS attacks from untrusted input containing HTML/JS. This escapes < to &lt;, causing HTML tags in dynamic variables to display as literal text instead of rendering.

postmarktemplatevariableescapingmustachioxss

Citations

https://stackoverflow.com/questions/65054422/postmark-template-dynamic-variable-with-html-processed-as-text-instead-of-html