In auth0-lock versions before and including 11.25.1 dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used the application and its users might be exposed to cross-site scripting (XSS) attacks.