XSS.js in the 7x7 Holiday challenge tests the incorrect check.
The check is for >script<alert(1)>/script< when the gt and lt should be swapped. This is forcing players to write the wrong solution to pass the check.
Good catch @Kabir . Security test is now fixed. Thank you 