Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d,[A]);else{B.model.beginUpdate();try{B.labelChanged(A,d),Graph.isLink(d)&&B.setLinkForCell(A,d)}finally{B.model.endUpdate()}}B.setSelectionCell(A)}else F=B.getInsertPoint(),B.isMouseInsertPoint()&&(M=0,B.lastPasteXml==d&&0<B.pasteCounter&&B.pasteCounter--),F=this.insertTextAt(d,F.x+M,F.y+M,A),B.setSelectionCells(F);B.isSelectionEmpty()||(B.scrollCellToVisible(B.getSelectionCell()),null!=this.hoverIcons&&this.hoverIcons.update(B.view.getState(B.getSelectionCell())));return F};EditorUi.prototype.pasteCells=