rest of header fields is rendered via util.escapeHTML which converts it correctly. This one is missed.
util.escapeHTML
PR #1286
Commit b905520d fixes this issue
Commit 53f3109f fixes this issue
This issue has been migrated to Fedora Forge: https://forge.fedoraproject.org/koji/koji/issues/1285
Please continue any further discussion there.