For every implementation make sure all the output is escaped in the correct way.Here a sheet with XSS examples: https://docs.adobe.com/docs/en/cq/5-6-1/developing/securitychecklist/_jcr_content/par/download/file.res/xss_cheat_sheet.pdf
Tried indeed several things, but it isn't working..What about creating a use-class that converts the String to a Map?Then your integration can stay as is.