Templates compiled from tainted sources and rendered into HTML sinks.
INLINE-1 (High): underscore template from hash → innerHTML
const tmpl = _.template(location.hash);
const output = tmpl({ name: 'user' });
document.getElementById('tmpl-target').innerHTML = output;
Template output lands here