JSFiddle - React, Tailwind, and code Playground

HTML

<iframe id="test-frame" sandbox>

</iframe>

CSS

iframe {
  margin-top: 40px;
}

JavaScript

var untrustedHtml = "<h1>test<\/h1><script>alert('evilness');<\/script>";
document.getElementById('test-frame').src = "data:text/html;charset=utf-8," + escape(untrustedHtml);