I would interpret that as a server-side render being improperly sanitized since obviously data from the server is being wrongfully executed. So that means eith

I would interpret that as a server-side render being improperly sanitized since obviously data from the server is being wrongfully executed. So that means either the server has to properly escape data or take additional steps to isolate data and code.