Language: TypeScript
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
  markClaimed: async function (inviteId = null, user) {
    const invite = await this.get(`id = ${inviteId}`);
    if (!invite) return { success: false, error: "Invite does not exist." };
    if (invite.status !== "pending")
      return { success: false, error: "Invite is not in pending status." };

    const db = await this.db();
    const { success, message } = await db
      .run(`UPDATE ${this.tablename} SET status=?,claimedBy=? WHERE id=?`, [
        "claimed",
        user.id,
        inviteId,
      ])
      .then(() => {
        return { success: true, message: null };
      })
      .catch((error) => {
        return { success: false, message: error.message };
      });

    db.close();
    if (!success) {
      console.error(message);
      return { success: false, error: message };
    }

    return { success: true, error: null };
  },