fix: use setUncheckedInnerHtml to avoid sanitization