BuddyPress.org

If you haven\’t altered any of the profile filtering mechanisms then the js will get removed. It gets filtered out by the standard wp filters which get run on the profile fields. The profile fields don\’t show up in the wp backend. If you have a user trying to insert js into a profile field I would delete that user. Now.

What version of bp are you running? I see all sorts of filtering going on in trunk.

bp-xprofile-filters.php