BuddyPress.org

There is an attribute_escape() call added to the content of the widget in 1.0.1, otherwise the widget poses as a potential security threat (unfiltered html).

You can remove the attribute_escape() call on line 42 of bp-core-widgets.php but you might be better off duplicating the widget and creating your own unfiltered version. You should be careful with this though.