Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null!=xa&&null!=xa.originalSrc&&(xa=m.createImageForPageLink(xa.originalSrc,ja));ka.background=wa;ka.backgroundImage=null!=xa?new mxImage(xa.src,xa.width,xa.height,xa.x,xa.y):null;ka.pageVisible=fa;ka.mathEnabled=oa;var Ka=ka.getGraphBounds;ka.getGraphBounds=function(){var Aa=Ka.apply(this,arguments),La=this.backgroundImage;if(null!=La&&null!=La.width&&null!=La.height){var Da=this.view.translate,va=this.view.scale;Aa=mxRectangle.fromRectangle(Aa);Aa.add(new mxRectangle((Da.x+La.x)*va,(Da.y+La.y)*
va,La.width*va,La.height*va))}return Aa};var Ja=ka.getGlobalVariable;ka.getGlobalVariable=function(Aa){return"page"==Aa?ja.getName():"pagenumber"==Aa?ia+1:"pagecount"==Aa?null!=m.pages?m.pages.length:1:Ja.apply(this,arguments)};document.body.appendChild(ka.container);m.updatePageRoot(ja);ka.model.setRoot(ja.root)}na=Ha(ka,na,ia!=ma,ja.getId());ka!=T&&ka.container.parentNode.removeChild(ka.container)}}else na=Ha(T);null==na||null==na.wnd?m.handleError({message:mxResources.get("errorUpdatingPreview")}):