Setting innerHTML with user-controlled data can lead to XSS attacks.
Use textContent, or sanitize with DOMPurify before assigning to innerHTML / dangerouslySetInnerHTML.