Demo 2 seems to be a problem with jsfiddle: https://jsfiddle.net/hegLkz4s/22/ https://jsfiddle.net/hegLkz4s/22/ It's also already been reported: https://gith

Demo 2 seems to be a problem with jsfiddle: https://jsfiddle.net/hegLkz4s/22/ https://jsfiddle.net/hegLkz4s/22/ It's also already been reported: https://github.com/jsfiddle/jsfiddle-issues/issues/963 https://github.com/jsfiddle/jsfiddle-issues/issues/963 You're right about there being an XSS vulnerability here though. But you can fix it pretty easily by escaping the HTML: https://jsfiddle.net/hegLkz4s/17/ https://jsfiddle.net/hegLkz4s/17/