Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    function getCardFieldUserValueTemplate(value, filter_terms) {
        const display_name = highlightFilterElements(value.display_name, filter_terms);
        if (value.user_url === null) {
            return html`<div class="tlp-avatar-mini"></div>
                <span>${display_name}</span>`;
        }

        return html`<a data-nodrag="true" class="extra-card-field-user" href="${value.user_url}">
            <div class="tlp-avatar-mini"><img loading="lazy" src="${value.avatar_url}" /></div>
            <span>${display_name}</span>
        </a>`;
    }