Should the following code be flagged for CWEs? Its loading a script from an outside source, so I assumed this is a problem. There is not a whitelist and the script is just added to the DOM.

export function createHubspotForm(portalId, formId, formclass) {

const targetDiv = document.createElement("div");

/* istanbul ignore else */

if (formclass) {

targetDiv.classList.add(formclass);

}

targetDiv.id = formId;

const script = document.createElement("script");

script.src = "//js.hsforms.net/forms/embed/v2.js";

script.charset = "utf-8";

script.async = true;

script.onload = function onLoad() {

loadHubspotForm(portalId, formId);

};

document.head.appendChild(script);

return targetDiv;

}