vuln location seems like there.

https://cs.github.com/element-plus/element-plus/blob/b8c38a9fe5365c1af99a0b2cb0ea9f9e3f68021a/packages/components/table/src/table-column/render-helper.ts#L148
They render the html as the code.

All Frontend Program used show-overflow-tooltips = true attr and concat the backend feedback into this column seems has this problem.

and morse over triggerred XSS