Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.prototype.addFontCss=function(k,y){y=null!=y?y:this.absoluteCssFonts(this.fontCss);if(null!=y){var G=k.getElementsByTagName("defs"),P=k.ownerDocument;0==G.length?(G=null!=P.createElementNS?P.createElementNS(mxConstants.NS_SVG,"defs"):P.createElement("defs"),null!=k.firstChild?k.insertBefore(G,k.firstChild):k.appendChild(G)):G=G[0];k=null!=P.createElementNS?P.createElementNS(mxConstants.NS_SVG,"style"):P.createElement("style");k.setAttribute("type","text/css");mxUtils.setTextContent(k,y);G.appendChild(k)}};