Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
typeof mxMermaidToDrawio)ea=da=va;va=m.cloneNode(!0);na.appendChild(va);Ma=function(Pa){O=null!=b.sidebar.tooltip&&"none"!=b.sidebar.tooltip.style.display};Oa=function(Pa){O||B(Ta,mxEvent.getClientX(Pa),mxEvent.getClientY(Pa),Sa,Da)};mxEvent.addGestureListeners(Sa,Ma,null,Oa);mxEvent.addGestureListeners(va,Ma,null,Oa)},function(va){b.handleError(va)})});Ka.setAttribute("disabled","disabled");Ka.className="geBtn gePrimaryBtn";oa=function(){window.setTimeout(function(){""!=ma.value?Ka.removeAttribute("disabled"):
Ka.setAttribute("disabled","disabled")},0)};ja=urlParams["smart-template"];null!=ja&&"1"!=ja&&(ma.value=decodeURIComponent(ja),oa(),"1"==urlParams["smart-template-generate"]&&window.setTimeout(function(){Ka.click()},0));mxEvent.addListener(ma,"change",oa);mxEvent.addListener(ma,"keydown",oa);mxEvent.addListener(ma,"cut",oa);mxEvent.addListener(ma,"paste",oa);mxEvent.addListener(ma,"keydown",function(Ja){13==Ja.keyCode&&Ka.click()});oa=document.createElement("div");oa.style.height="40px";oa.style.marginTop=