Checkmarx vulnerability - if embeds untrusted data

Question

I have this code:

                _addIconForDropDownMenu : function() {
                    if (this.getConfig('tabDropdownMenu')) {
                        $(this.$root.find('span.ossui_dropdown_icon'))
                                .closest("li").remove();
                        $(this.menuIconTemplate)
                                .insertAfter(
                                        this.$root
                                                .find(
                                                        ".ossui-pagetabs-nav-bar .ossui-addtab-icon")
                                                .closest('li'));
                        this._createDropdownMenuOnOverflow();
                    }
                },

and i get this checkmarx issue:

The method if embeds untrusted data in generated output with $, at line 4567 of ui.js. This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page. Similarity ID: -2086290339

I didn't understand what this checkmarx mean and how to solve it. I tried to use GPT and he changed my method to be like this:

_addIconForDropDownMenu: function() {
    if (this.getConfig('tabDropdownMenu')) {
        // Sanitize or encode the untrusted data before using it with jQuery
        var untrustedData = ''; // Replace this with the source of untrusted data

        // Example of sanitization (assuming untrustedData is a string)
        var sanitizedData = sanitizeFunction(untrustedData);

        // Example of encoding (assuming untrustedData is a string)
        var encodedData = encodeHTML(untrustedData);

        // Example usage with jQuery ($)
        $(sanitizedData).closest("li").remove();
        $(encodedData).insertAfter(
            this.$root.find(".ossui-pagetabs-nav-bar .ossui-addtab-icon").closest('li')
        );

        this._createDropdownMenuOnOverflow();
    }
},

// Example function to sanitize data (sanitizeFunction)
function sanitizeFunction(data) {
    // Implement your sanitization logic here
    // Return sanitized data
}

// Example function to encode HTML entities (encodeHTML)
function encodeHTML(str) {
    return str.replace(/[&<>"']/g, function(match) {
        return {
            '&': '&amp;',
            '<': '&lt;',
            '>': '&gt;',
            '"': '&quot;',
            "'": '&#39;'
        }[match];
    });
}

and still i don't understand what is this checkmarx, where can be injection? and the GPT solution.

Tnx