There were security vulnerabilities a while ago that resulted from people being able to upload React-element-shaped JSON objects in certain places strings were

There were security vulnerabilities a while ago that resulted from people being able to upload React-element-shaped JSON objects in certain places strings were supposed to go. IIRC this allowed for XSS, so React added a special symbol (the $$typeof key) that would have to be imported somehow in order to add it to the plain objects.