Passwords incorrectly are getting HTML-escaped

If you pass `&` (or, I will speculate, `<` and `>` as well) as characters of the DB password to `wp core config`, those HTML-sensitive characters get escaped to `&amp;`   (and other HTML entities respectively) incorrectly.