v-html interprets the string passed to it as raw html, without escaping. We should use v-text wherever possible.