Per @csteipp:
In [card.hogan the thumbnail URL isn't sanitised, escaped, or enclosed in single quotes](https://github.com/wikimedia/mediawiki-extensions-Cards/blob/5b392e84383d4886b3866098543d64c4bc3d054d/resources/view/card.hogan#L4).
So:
- while processing the result of the API call, the thumbnail URL should be escaped (see CSS.escape for inspiration)
- the thumbnail URL must start with http[s]://
- surround the thumbnail URL with single quotes