JS code in Target activity

Hi there

As such, Adobe Target does not perform exhaustive validation on custom JavaScript entered into activity offers. In other words, the responsibility for security of injected JS lies mainly with client-side governance and your organization’s own code review practices.

This means that potentially unsafe JS (including code that could trigger cross-site scripting/XSS or client-side vulnerabilities) can be inserted into Target offers if not properly controlled (through e.g. CSP, code reviews, avoidance of eval(), etc.).

Maybe this helps

https://wwwimages2.adobe.com/content/dam/cc/en/security/pdfs/AdobeTargetSecurityOverview.pdf