Javascript function that convert HTML to plain text

Javascript: HTML to text

// converts HTML to text using Javascript
function html2text(html) {
    var tag = document.createElement('div');
    tag.innerHTML = html;
    
    return tag.innerText;
}

This code is having XSS security issue.