Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
`+this.showPosition(),{text:"",token:null,line:this.yylineno});return this},less:function(zn){this.unput(this.match.slice(zn))},pastInput:function(){var zn=this.matched.substr(0,this.matched.length-this.match.length);return(zn.length>20?"...":"")+zn.substr(-20).replace(/\n/g,"")},upcomingInput:function(){var zn=this.match;return zn.length<20&&(zn+=this._input.substr(0,20-zn.length)),(zn.substr(0,20)+(zn.length>20?"...":"")).replace(/\n/g,"")},showPosition:function(){var zn=this.pastInput(),Zn=new Array(zn.length+1).join("-");return zn+this.upcomingInput()+`