title: is this possible as an XSS exploit in Javascript
body: <p>I'm working through some legacy apps and curious whether this would be a viable XSS exploit?</p>
  
  <p>code:</p>
  
  <pre><code>&lt;div id="demo"&gt;&lt;/div&gt;
  
  &lt;script&gt;
  
  document.getElementById("demo").innerHTML = '&lt;script src="/me.js"&gt;&lt;/script&gt;';
  &lt;/script&gt;
  </code></pre>
  
  <p>I don't think so but there's smarter people out there than me. Is there a variation of this? </p>