Find Security Issue

Could you find a security issue in this code snippet?

Asked in frontend interviews at Karat and Atlassian