Ugandan Knuckles

Difficulty is Easy.
Pop an alert(1337) on sandbox.pwnfunction.com.
No user interaction.
Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
Tested on Chrome.

<!-- Challenge -->
<div id="uganda"></div>
<script>
    let wey = (new URL(location).searchParams.get('wey') || "do you know da wey?");
    wey = wey.replace(/[<>]/g, '')
    uganda.innerHTML = `<input type="text" placeholder="${wey}" class="form-control">`
</script>

The GET parameter wey becomes a part of the uganda.innerHTML, but before that it filters a bunch of characters out.

wey = wey.replace(/[<>]/g, '')

The lesser-than(<) & greater-than(>) characters are removed, this means we can't create new tags. But quotes are not removed, so we can break out of the placeholder and inject some attributes. Since we can't have user interactions, we can use onfocus event handler and then autofocus the input to trigger your code.

"onfocus=alert(1337) autofocus="