    menuItemTemplate: function (item) {
      let link = document.createElement("a");
      link.innerText = item.string;
      return link.outerHTML;
    },
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.