This is going to be very app specific but 'products' might be a list of products in a shopping cart and the products can be submitted to the store by third part

This is going to be very app specific but 'products' might be a list of products in a shopping cart and the products can be submitted to the store by third parties with arbitrary names. Then all an attacker has to do is to trick you into adding his evil product to your cart. Alternatively, products might be some kind of client side cache of products from the server and the attacker might not even have to trick you into adding something to your cart. Of course it could be possible that the 'name' value is HTML and not TEXT and has already been pre-escaped. :) Regardless of whether this is exploitable XSS or not this is probably a correctness issue. Stuff shouldn't start breaking when people start inputting '<' somewhere.