Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
d.appendChild(K);mxUtils.br(d);this.init=function(){K.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?K.select():document.execCommand("selectAll",!1,null)};mxUtils.write(d,mxResources.get("top")+":");var E=document.createElement("input");E.setAttribute("type","text");E.setAttribute("size","4");E.style.marginRight="16px";E.style.marginLeft="4px";E.value=D;d.appendChild(E);mxUtils.write(d,mxResources.get("height")+":");var R=document.createElement("input");R.setAttribute("type","text");