Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Xa?this.src=Xa:(this.src=Editor.errorImage,this.onerror=null)};mxEvent.addGestureListeners(ua,mxUtils.bind(this,function(Na){C(ua,null,null,da,va,ya)}),null,null);mxEvent.addListener(ua,"dblclick",function(Na){G();mxEvent.consume(Na)})}else if(!Ha&&null!=da&&0<da.length){var Qa=function(Na){H.setAttribute("disabled","disabled");ua.style.backgroundColor="transparent";ua.style.border="1px solid transparent";B.spin(ha);La(da,function(Ya,Wa){B.stop();null!=Ya&&(C(ua,Ya,la,null,null,ya,Wa),Na&&G())})};