Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(){var b=new mxObjectCodec(new ChangeGridColor,["ui"]);b.beforeDecode=function(e,g,n){n.ui=e.ui;return g};mxCodecRegistry.register(b)})();(function(){EditorUi.VERSION="21.6.2";EditorUi.compactUi="atlas"!=Editor.currentTheme;Editor.isDarkMode()&&(mxGraphView.prototype.gridColor=mxGraphView.prototype.defaultDarkGridColor);EditorUi.enableLogging="1"!=urlParams.stealth&&"1"!=urlParams.lockdown&&(/.*\.draw\.io$/.test(window.location.hostname)||/.*\.diagrams\.net$/.test(window.location.hostname))&&"support.draw.io"!=window.location.hostname;EditorUi.drawHost=window.DRAWIO_BASE_URL;EditorUi.lightboxHost=window.DRAWIO_LIGHTBOX_URL;