Maybe it’s a solution to urlencode your string or add the CDATA tag in the string.
See for some background this thread on stackoverflow: https://stackoverflow.com/questions/1398571/html-inside-xml-should-i-use-cdata-or-encode-the-html
I had this problem as well, and raised it a potential bug a few weeks ago. The response from Mendix was that this was expected behaviour, and I needed to handle the encoding myself.