UNSAFE_HTML_SINK: HTML written from a string

Severity	Fault	Stage
error	customer (the source package)	build output

What it means

The component writes as HTML (innerHTML, outerHTML, insertAdjacentHTML, srcdoc, setHTMLUnsafe, createContextualFragment or dangerouslySetInnerHTML) a string that is not a fixed literal, or a literal that runs script (a <script> element, an on… handler attribute, a javascript: URL). When the string comes from a prop, an attribute of the page or an API, markup such as <img onerror> in it runs script in the host page (rule html-sink).

How to fix

Render the content with JSX ({message} is escaped), or set textContent; for formatting, accept structured data (a list of paragraphs, bold ranges) instead of HTML.