Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ba.style.whiteSpace="nowrap";ba.style.position="absolute";ba.style.overflow="hidden";ba.style.bottom="6px";ba.style.height="42px";ba.style.right="10px";ba.style.left="10px";Q.isEnabled()&&(ba.appendChild(aa),ba.appendChild(ca),Z.appendChild(ba));null!=O&&ba.appendChild(O);return{div:Z,refresh:da}};Graph.prototype.getCustomFonts=function(){var m=this.extFonts;m=null!=m?m.slice():[];for(var z in Graph.customFontElements){var J=Graph.customFontElements[z];m.push({name:J.name,url:J.url})}return m};Graph.prototype.setFont=