Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(h){(function(y){(function(A){(function(B){var m=function(){function g(){this.colorElementMap={};this.fontElementMap={}}g.__static_initialize=function(){g.__static_initialized||(g.__static_initialized=!0,g.__static_initializer_0())};g.defaultColors_$LI$=function(){g.__static_initialize();null==g.defaultColors&&(g.defaultColors={});return g.defaultColors};g.__static_initializer_0=function(){g.defaultColors_$LI$()["0"]="#000000";g.defaultColors_$LI$()["1"]="#FFFFFF";g.defaultColors_$LI$()["2"]=
"#FF0000";g.defaultColors_$LI$()["3"]="#00FF00";g.defaultColors_$LI$()["4"]="#0000FF";g.defaultColors_$LI$()["5"]="#FFFF00";g.defaultColors_$LI$()["6"]="#FF00FF";g.defaultColors_$LI$()["7"]="#00FFFF";g.defaultColors_$LI$()["8"]="#800000";g.defaultColors_$LI$()["9"]="#008000";g.defaultColors_$LI$()["10"]="#000080";g.defaultColors_$LI$()["11"]="#808000";g.defaultColors_$LI$()["12"]="#800080";g.defaultColors_$LI$()["13"]="#008080";g.defaultColors_$LI$()["14"]="#C0C0C0";g.defaultColors_$LI$()["15"]="#E6E6E6";
g.defaultColors_$LI$()["16"]="#CDCDCD";g.defaultColors_$LI$()["17"]="#B3B3B3";g.defaultColors_$LI$()["18"]="#9A9A9A";g.defaultColors_$LI$()["19"]="#808080";g.defaultColors_$LI$()["20"]="#666666";g.defaultColors_$LI$()["21"]="#4D4D4D";g.defaultColors_$LI$()["22"]="#333333";g.defaultColors_$LI$()["23"]="#1A1A1A"};g.prototype.initialise=function(b,a){if(null!=b){a=b.getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.COLORS);if(0<a.length){var c=a.item(0).getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.COLOR_ENTRY),