Tor is aware of a technical issue that allows JavaScript execution in the Safest security level of Tor Browser in some situations.

Until then, do the following to completely disable JavaScript instead of setting the security level:

Open the address about:config in Tor Browser. Click the I accept the risk! button. At the top of the page, search for javascript.enabled. Double-click on the javascript.enabled line in the results to set its value to false.

This issue will be fixed in the next release of Tails.