As you said, I see that <script> tags are removed with st.markdown(raw_html, unsafe_allow_html=True).
If that’s case, (that is, if we cannot inject JS using that), why is this still called unsafe?
As you said, I see that <script> tags are removed with st.markdown(raw_html, unsafe_allow_html=True).
If that’s case, (that is, if we cannot inject JS using that), why is this still called unsafe?