Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
x instanceof mxValueChange&&null!=x.cell&&null!=x.cell.value&&"object"==typeof x.cell.value&&this.invalidateDescendantsWithPlaceholders(x.cell)};Graph.prototype.invalidateDescendantsWithPlaceholders=function(x){x=this.model.getDescendants(x);if(0<x.length)for(var L=0;L<x.length;L++){var P=this.view.getState(x[L]);null!=P&&null!=P.shape&&null!=P.shape.stencil&&this.stencilHasPlaceholders(P.shape.stencil)?this.removeStateForCell(x[L]):this.isReplacePlaceholders(x[L])&&this.view.invalidate(x[L],!1,!1)}};