The same mistake, one step later: this time the browser is the program being fooled.
Cross-site scripting
Also called XSS
An attacker gets their text into your page, and the visitor's browser runs it as code. That code runs as your site, with the visitor's logged-in session, so it can do whatever they can.
A comment box is enough. Everyone who views the comment runs the attacker's script, and passing tests won't show it, because a test comment like "hello" looks right either way.
Say it to your agent
“Render this comment as plain text with {comment}, not dangerouslySetInnerHTML. If we have to allow formatting, sanitise with DOMPurify and add a test that <img src=x onerror=alert(1)> ends up as text in the DOM.”