Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
urlParams.dev?mxscript("js/diagramly/Extensions.js",function(){mxscript("js/orgchart/bridge.min.js",function(){mxscript("js/orgchart/bridge.collections.min.js",function(){mxscript("js/orgchart/OrgChart.Layout.min.js",function(){mxscript("js/orgchart/mxOrgChartLayout.js",x,null,null,null,t)},null,null,null,t)},null,null,null,t)},null,null,null,t)},null,null,null,t):mxscript("js/extensions.min.js",x,null,null,null,t))}),q)};EditorUi.prototype.createMermaidXml=function(c,e,g,q,p){var t=new Graph(document.createElement("div"));
g=t.insertVertex(null,null,null,0,0,q,p,"shape=image;noLabel=1;verticalAlign=top;imageAspect=1;image="+g+";");t.setAttributeForCell(g,"mermaidData",JSON.stringify({data:c,config:e},null,2));c=(new mxCodec).encode(t.getModel());return mxUtils.getXml(c)};EditorUi.prototype.generateOpenAiMermaidDiagram=function(c,e,g){var q=0,p=mxUtils.bind(this,function(){this.spinner.spin(document.body,mxResources.get("loading"))&&this.createTimeout(4E4,mxUtils.bind(this,function(t){EditorUi.logEvent({category:"OPENAI-DIAGRAM",