$leading and $trailing shouldn't be escaped.

Mustache.php

@@ -619,7 +619,8 @@ class Mustache {
 	 * @return string
 	 */
 	protected function _renderEscaped($tag_name, $leading, $trailing) {
-		return htmlentities($this->_renderUnescaped($tag_name, $leading, $trailing), ENT_COMPAT, $this->_charset);
+		$rendered = htmlentities($this->_renderUnescaped($tag_name, '', ''), ENT_COMPAT, $this->_charset);
+		return $leading . $rendered . $trailing;
 	}
 
 	/**