Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    __add_row(row) {
        var tr = document.createElement('tr');
        tr.id = "tr_" + this.__uuidv4();
        for (var col of row) {
            var td = document.createElement('td');
            td.innerHTML = col;
            tr.appendChild(td);
        }
        this.__add_action_button(tr);
        this.tbody.appendChild(tr);
        return tr.id;
    }