Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
  global.confirmPrompt = function confirmPrompt(message, title) {
    var dfd = $.Deferred();
    message = $('<div>', {width: 400, html: message});
    new ConfirmPopup(title || $T('Please confirm'), message, function(confirmed) {
      if (confirmed) {
        dfd.resolve();
      } else {
        dfd.reject();
      }
    }).open();
    return dfd.promise();
  };