Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVsdxCanvas2D.prototype.ellipse=function(h,y,A,B){1<this.geoStepIndex&&this.createGeoSec();var m=this.state;A*=m.scale;B*=m.scale;var g=this.xmGeo,b=g.height*m.scale,a=g.width*m.scale;h=(h-g.x+m.dx)*m.scale;y=b+(-y+g.y-m.dy)*m.scale;this.geoSec.appendChild(this.createRowScaled("Ellipse",this.geoStepIndex++,h+A/2,y-B/2,h,y-B/2,h+A/2,y,"Width*"+(h+A/2)/a,"Height*"+(y-B/2)/b,"Width*"+h/a,"Height*"+(y-B/2)/b,"Width*"+(h+A/2)/a,"Height*"+y/b))};