Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
g.length&&0<x.length){this.model.beginUpdate();try{for(var F=0;F<g.length;F++){for(var M=this.getTagsForCell(g[F]),P=M.split(" "),T=!1,W=0;W<x.length;W++){var U=mxUtils.trim(x[W]);""!=U&&0>mxUtils.indexOf(P,U)&&(M=0<M.length?M+" "+U:U,T=!0)}T&&this.setAttributeForCell(g[F],"tags",M)}}finally{this.model.endUpdate()}}};Graph.prototype.removeTagsForCells=function(g,x){if(0<g.length&&0<x.length){this.model.beginUpdate();try{for(var F=0;F<g.length;F++){var M=this.getTagsForCell(g[F]);if(0<M.length){for(var P=