I don't quite understand. Does XSS mean it runs user submitted js code? I thought it would have a parser that parses the submitted code to generate its own gra

I don't quite understand. Does XSS mean it runs user submitted js code? I thought it would have a parser that parses the submitted code to generate its own graph representation. there shouldn't be a chance for running js, no?