Looking at the source code of the code-editor [1], it seems to be embedding https://onecompiler.com via the iframe and delegating code compilation and execution to it. So I guess it's a question to onecompiler, whether they sanitize input or not. :)

[1]: https://github.com/shikaan/shikaan.github.io/blob/main/_incl...