Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
u=null;t.getModel().beginUpdate();try{u=t.insertVertex(null,null,"<pre>"+d+"</pre>",g,n,1,1,"text;html=1;align=left;verticalAlign=top;"),t.updateCellSize(u,!0)}finally{t.getModel().endUpdate()}return u};EditorUi.prototype.insertTextAt=function(d,g,n,t,u,v,A,H){v=null!=v?v:!0;A=null!=A?A:!0;if(null!=d)if(Graph.fileSupport&&(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d))this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):this.parseFileData(d.replace(/\s+/g,