diff --git a/js/mzta-placeholders.js b/js/mzta-placeholders.js
index c666e858..48de04a3 100644
--- a/js/mzta-placeholders.js
+++ b/js/mzta-placeholders.js
@@ -17,7 +17,10 @@
  */
 
 import { prefs_default } from '../options/mzta-options-default.js';
-import { getMailHeader } from './mzta-utils.js';
+import {
+    getMailHeader,
+    sanitizeMailHeaders
+ } from './mzta-utils.js';
 
 /*  ================= PLACEHOLDERS PROPERTIES ========================================
 
@@ -545,7 +548,7 @@ export const placeholdersUtils = {
                     finalSubs['mail_folder_path'] = placeholdersUtils.failSafePlaceholders(curr_message.folder?.path);
                     break;
                 case 'mail_headers':
-                    finalSubs['mail_headers:' + currPH.custom_value] = placeholdersUtils.failSafePlaceholders(await getMailHeader(curr_message, currPH.custom_value));
+                    finalSubs['mail_headers:' + currPH.custom_value] = placeholdersUtils.failSafePlaceholders(sanitizeMailHeaders(await getMailHeader(curr_message, currPH.custom_value)));
                     break;
                 case 'selected_text':
                     finalSubs['selected_text'] = placeholdersUtils.failSafePlaceholders(selection_text);
@@ -560,13 +563,13 @@ export const placeholdersUtils = {
                     finalSubs['mail_html_body_or_selected'] = placeholdersUtils.failSafePlaceholders(selection_html || msg_text?.html);
                     break;
                 case 'author':
-                    finalSubs['author'] = placeholdersUtils.failSafePlaceholders(curr_message.author);
+                    finalSubs['author'] = placeholdersUtils.failSafePlaceholders(sanitizeMailHeaders(curr_message.author));
                     break;
                 case 'recipients':
-                    finalSubs['recipients'] = placeholdersUtils.failSafePlaceholders(curr_message.recipients?.join(", "));
+                    finalSubs['recipients'] = placeholdersUtils.failSafePlaceholders(sanitizeMailHeaders(curr_message.recipients?.join(", ")));
                     break;
                 case 'cc_list':
-                    finalSubs['cc_list'] = placeholdersUtils.failSafePlaceholders(curr_message.ccList?.join(", "));
+                    finalSubs['cc_list'] = placeholdersUtils.failSafePlaceholders(sanitizeMailHeaders(curr_message.ccList?.join(", ")));
                     break;
                 case 'junk_score':
                     finalSubs['junk_score'] = placeholdersUtils.failSafePlaceholders(curr_message.junkScore);
diff --git a/js/mzta-utils.js b/js/mzta-utils.js
index a8aabdb2..ab8d7ef5 100644
--- a/js/mzta-utils.js
+++ b/js/mzta-utils.js
@@ -207,7 +207,8 @@ export async function getMailHeader(curr_message, mail_header_id) {
   let full_message = await browser.messages.getFull(curr_message.id);
   // console.log(">>>>>>>>>>>> getMailHeader full_message: " + JSON.stringify(full_message));
   if(full_message.hasOwnProperty("headers") && Object.keys(full_message.headers).some(header => header.toLowerCase() === mail_header_id.toLowerCase())){
-    mail_header_value = full_message.headers[Object.keys(full_message.headers).find(header => header.toLowerCase() === mail_header_id.toLowerCase())];
+    const raw_value = full_message.headers[Object.keys(full_message.headers).find(header => header.toLowerCase() === mail_header_id.toLowerCase())];
+    mail_header_value = Array.isArray(raw_value) ? raw_value.join(", ") : raw_value;
   }
   // console.log(">>>>>>>>>>>> getMailHeader mail_header_value: " + mail_header_value)
   return mail_header_value;
@@ -218,6 +219,12 @@ export function sanitizeHtml(input) {
   return input.replace(/<(?!br\s*\/?)[^>]+>/gi, '');
 }
 
+export function sanitizeMailHeaders(input){
+  console.log(">>>>>>>>>>>> sanitizeMailHeaders input: " + JSON.stringify(input));
+  if(!input) return '';
+  return input.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
 export function stripHtmlKeepLines(htmlString) {
   // Replaces <p> tags with a newline at the beginning
   // and removes all other HTML tags