Spot the bug in the localized welcome

from Internationalization
Node 24 intermediate 4 min 1 issue to find

Find the security boundary broken by this localized welcome message.

JavaScript
function showWelcome(container, messages, customerName) {
  const welcome = messages.welcome.replace(
    "{customerName}",
    customerName,
  );
  container.innerHTML = welcome;
}
Open in playground
Report an error