experience-cms-content-render

No explicit malware/backdoor behavior is evident in this module. However, it contains a significant client-side security risk: rich text defaults to an unsanitized pass-through and is rendered via dangerouslySetInnerHTML (or passed as html to a slot). If untrusted CMS content reaches props.body without a robust sanitizer being set via setRichTextSanitizer, this can enable DOM XSS. Additionally, untrusted URLs are used for external links and untrusted image URLs are loaded, which can be abused for phishing/navigation and tracking, though those are secondary to the XSS sink.