Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
async function _alertFromGet(type) {
    if (urlParams.has(type)) {
        var msg = urlParams.get(type);
        var div = document.createElement("div");
        div.innerHTML = msg;
        var text = div.textContent || div.innerText || "";
        if (!empty(text)) {
            switch (type) {
                case 'error':
                    avideoAlertError(text);
                    break;
                case 'msg':
                    avideoAlertInfo(text);
                    break;
                case 'success':
                    avideoAlertSuccess(text);
                    break;
                case 'toast':
                    avideoToast(text);
                    break;
            }
            var url = removeGetParam(window.location.href, type);
            window.history.pushState({}, document.title, url);
        }
    }
}