This looks like a XSS vulnerability. Replace `innerHTML` with `textContent` to fix the issue.