Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
function combosVariations(options, optionIndex=0, results=[], current={}) {
    
    var allKeys = Object.keys(options);
    var optionKey = allKeys[optionIndex];

    var list = options[optionKey];

    list.forEach( item => {

        current[optionKey] = item;

        if (optionIndex + 1 < allKeys.length) {
            combosVariations(options, optionIndex + 1, results, current);
        } else {
            // The easiest way to clone an object.
            var res = JSON.parse(JSON.stringify(current));
            results.push(res);
        }

    });

    return results;

}