Stupid me. I missread the code and did a proof of concept in jsbin just adding &quot;&lt;&#x2F;script&gt;&lt;script&gt;alert(&#x27;XSS&#x27;);&lt;&#x2F;script&gt;&lt;script&gt;&quot; as a hobby. Now I realise that I added it in the HTML view so I was just closing the original &lt;script&gt; tag. So, no XSS issues, AFAIK. I am updating my original response to reflect this.<p>Nevertheless, using a framework like React protects you automatically from accidentally adding XSS vulnerabilities.