Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.loadOrgChartLayouts=function(c){this.createTimeout(null,mxUtils.bind(this,function(e){var g=mxUtils.bind(this,function(){this.loadingOrgChart=!1;e.clear()&&(Graph.layoutNames.push("mxOrgChartLayout"),this.spinner.stop(),c())}),q=mxUtils.bind(this,function(p){this.loadingOrgChart=!1;e.clear()&&this.handleError(p)});"undefined"!==typeof mxOrgChartLayout||this.loadingOrgChart||this.isOffline(!0)?g():this.spinner.spin(document.body,mxResources.get("loading"))&&(this.loadingOrgChart=
!0,"1"==urlParams.dev?mxscript("js/orgchart/bridge.min.js",function(){mxscript("js/orgchart/bridge.collections.min.js",function(){mxscript("js/orgchart/OrgChart.Layout.min.js",function(){mxscript("js/orgchart/mxOrgChartLayout.js",g,null,null,null,q)},null,null,null,q)},null,null,null,q)},null,null,null,q):mxscript(DRAWIO_BASE_URL+"/js/orgchart.min.js",g,null,null,null,q))}),onerror)};EditorUi.prototype.importCsv=function(c,e){this.loadOrgChartLayouts(mxUtils.bind(this,function(){this.doImportCsv(c,