XSS: `v-safe-html` is not safe enough