Hint 1

Try embedding a script on the page by adding a todo item containing script tags.

<script>alert(1)</script>