Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
y=document.createElement("div");y.style.height="300px";y.style.width="300px";y.style.display="inline-flex";y.style.justifyContent="center";y.style.alignItems="center";y.style.position="absolute";var E=document.createElement("img");E.onload=function(){function F(){z.model.setStyle(d,g+k())}z=new Graph(D);z.autoExtend=!1;z.autoScroll=!1;z.setGridEnabled(!1);z.setEnabled(!0);z.setPanning(!1);z.setConnectable(!1);z.getRubberband().setEnabled(!1);z.graphHandler.allowLivePreview=!1;var S=z.createVertexHandler;