Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
try{n.pasteXml(K,!0)}finally{q.getModel().endUpdate()}}else mxClipboard.paste(q)}),F=!0)}catch(K){}F||mxClipboard.paste(q)}},!1,"sprite-paste",Editor.ctrlKey+"+V");this.addAction("pasteHere",function(F){function K(W){if(null!=W){for(var d=!0,f=0;f<W.length&&d;f++)d=d&&q.model.isEdge(W[f]);var k=q.view.translate;f=q.view.scale;var v=k.x,z=k.y;k=null;if(1==W.length&&d){var A=q.getCellGeometry(W[0]);null!=A&&(k=A.getTerminalPoint(!0))}k=null!=k?k:q.getBoundingBoxFromGeometry(W,d);null!=k&&(d=Math.round(q.snap(q.popupMenuHandler.triggerX/