Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
K&&B(Editor.svgBrokenImage.src)};U.src=m}}catch(W){B(Editor.svgBrokenImage.src)}};Editor.prototype.convertImages=function(m,B,K,R){null==R&&(R=this.createImageUrlConverter());var U=0,W=K||{};K=mxUtils.bind(this,function(Q,V){Q=m.getElementsByTagName(Q);for(var X=0;X<Q.length;X++)mxUtils.bind(this,function(Y){try{if(null!=Y){var Z=R.convert(Y.getAttribute(V));if(null!=Z&&"data:"!=Z.substring(0,5)){var ca=W[Z];null==ca?(U++,this.convertImageToDataUri(Z,function(da){null!=da&&(W[Z]=da,Y.setAttribute(V,
da));U--;0==U&&B(m)})):Y.setAttribute(V,ca)}else null!=Z&&Y.setAttribute(V,Z)}}catch(da){}})(Q[X])});K("image","xlink:href");K("img","src");0==U&&B(m)};Editor.base64Encode=function(m){for(var B="",K=0,R=m.length,U,W,Q;K<R;){U=m.charCodeAt(K++)&255;if(K==R){B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4);B+="==";break}W=m.charCodeAt(K++);if(K==R){B+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>