Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
c)+"px",C.style.top=Math.max(0,e+70)+"px",mxUtils.setPrefixedStyle(C.style,"borderRadius","6px"),mxUtils.setPrefixedStyle(C.style,"transform","translate(-50%,-50%)"),Editor.isDarkMode()||mxUtils.setPrefixedStyle(C.style,"boxShadow","2px 2px 3px 0px #ddd"),"..."!=G.substring(G.length-3,G.length)&&"!"!=G.charAt(G.length-1)&&(G+="..."),C.innerHTML=G,A.appendChild(C),p.status=C),this.pause=mxUtils.bind(this,function(){var V=function(){};this.active&&(V=mxUtils.bind(this,function(){this.spin(A,G)}));this.stop();