Language: JavaScript
Label: vulnerable
CWE: CWE-526 \u2014 Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information.

Code:
function escapeArgForInterpolation(arg) {
  return arg
    .replace(/[\0\u0008\u001B\u009B]/gu, "")
    .replace(/\r?\n|\r/gu, " ")
    .replace(/\^/gu, "^^")
    .replace(/(["&<>|])/gu, "^$1");
}