<script>
  export let attack = '" onload="alert(\'uhoh\')" data-nothing="not important';
</script>

<div style:--css-variable={attack} />
