Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.createStatusContainer=function(){var b=document.createElement("a");b.className="geItem geStatus";mxEvent.addListener(b,"click",mxUtils.bind(this,function(e){var g=mxEvent.getSource(e);if("A"!=g.nodeName){var n=g.getAttribute("data-action");if("statusFunction"==n&&null!=this.editor.statusFunction)this.editor.statusFunction();else if(null!=n)g=this.actions.get(n),null!=g&&g.funct();else{n=g.getAttribute("data-title");var y=g.getAttribute("data-message");null!=n&&null!=y?this.showError(n,
y):(g=g.getAttribute("data-link"),null!=g&&this.editor.graph.openLink(g))}mxEvent.consume(e)}}));return b};