What is the danger in dynamically linking a script?

Question

JavaScript

Hello!
There is a javascript widget/module. It has an init() and a render() method.
For what? In init() I request json data from the server. In render() - show on the page.
What security issues might arise if I put a tag <script>with a request for a polyfill in init(), because, let's say, only my module needs it?
upd. ok, XSS is possible. How to do this safely?

Answer 1

If tags are not filtered and special characters are not escaped, then XSS is possible .
It is necessary to escape characters, for example, in a simple way, or with special libraries, such as this one .