There's not a risk directly, but it conflicts with newer CSP (Content Security Policy) headers. So you can set CSP to only allow external JS (to prevent XSS thr

There's not a risk directly, but it conflicts with newer CSP (Content Security Policy) headers. So you can set CSP to only allow external JS (to prevent XSS through a parameter echoed on your page, for example). Then, it will block any inline JS (including the injection). So it's not a security risk, just something that helps prevent XSS through CSP.