SECURITY: ERB execution in custom Email Style

app/helpers/email_helper.rb

@@ -25,12 +25,8 @@ module EmailHelper
     raw "<a href='#{Discourse.base_url}#{url}' style='color: ##{@anchor_color}'>#{title}</a>"
   end
 
-  def email_html_template(binding_arg)
-    template = EmailStyle.new.html.sub(
-      '%{email_content}',
-      '<%= yield %><% if defined?(html_body) %><%= html_body %><% end %>'
-    )
-    ERB.new(template).result(binding_arg)
+  def email_html_template
+    EmailStyle.new.html.sub('%{email_content}', yield).html_safe
   end
 
   protected