Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function getGoogleAnalyticsScript(tagId) {
    let escapedTagId = jsesc(tagId, { isScriptContext: true });

    if (escapedTagId) {
        escapedTagId = escapedTagId.trim();
    }

    return `
        <script async src="https://www.googletagmanager.com/gtag/js?id=${escapedTagId}"></script>
        <script>window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date());gtag('config', '${escapedTagId}'); </script>
    `;
}