Cannot determine what 'ejs' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'ejs' is not externally controlled, or sanitize this data.
assert.equal(ejs.render('<%- name %>', {name: '<script>'}),