Language: JavaScript
Label: safe
CWE: CWE-829 \u2014 Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Code:
function combosVariations(options, optionIndex=0, results=[], current={}) {
    
    var allKeys = Object.keys(options);
    var optionKey = allKeys[optionIndex];

    var list = options[optionKey];

    list.forEach( item => {

        current[optionKey] = item;

        if (optionIndex + 1 < allKeys.length) {
            combosVariations(options, optionIndex + 1, results, current);
        } else {
            // The easiest way to clone an object.
            var res = JSON.parse(JSON.stringify(current));
            results.push(res);
        }

    });

    return results;

}