Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
T,m,B,K){l=mxEvent.isAltDown(n)?l:v.getCenterInsertPoint(new mxRectangle(0,0,B,K));var R=null;v.getModel().beginUpdate();try{R="txt"==T?b.insertAsPreText(m,l.x,l.y):v.insertVertex(null,null,null,l.x,l.y,B,K,"shape=image;noLabel=1;verticalAlign=top;aspect=fixed;imageAspect=0;image="+b.convertDataUri(m)+";"),v.setAttributeForCell(R,"plantUmlData",JSON.stringify({data:N,format:T},null,2))}finally{v.getModel().endUpdate()}null!=R&&(v.setSelectionCell(R),v.scrollCellToVisible(R))},v=b.editor.graph,A="plantUmlTxt"==