Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxResources.get("loading")))for(var x=c.length,F=x,M=[],P=mxUtils.bind(this,function(W,U){M[W]=U;if(0==--F){this.spinner.stop();if(null!=A)A(M);else{var X=[];H.getModel().beginUpdate();try{for(W=0;W<M.length;W++){var Z=M[W]();null!=Z&&(X=X.concat(Z))}}finally{H.getModel().endUpdate()}}t(X)}}),T=0;T<x;T++)mxUtils.bind(this,function(W){var U=c[W];if(null!=U){var X=new FileReader;X.onload=mxUtils.bind(this,function(Z){if(null==y||y(U))try{if("image/"==U.type.substring(0,6))if("image/svg"==U.type.substring(0,