Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ab,Wa,0,Na,Ya,$a);La.pageSelector=!1;La.mathEnabled=!1;da.checked&&(La.isCellVisible=function(Za){return Aa.isCellSelected(Za)});Na=m.getCurrentFile();null!=Na&&(La.title=Na.getTitle());var hb=La.writeHead;La.writeHead=function(Za){hb.apply(this,arguments);mxClient.IS_GC&&(Za.writeln('<style type="text/css">'),Za.writeln("@media print {"),Za.writeln(".MathJax svg { shape-rendering: crispEdges; }"),Za.writeln("}"),Za.writeln("</style>"));null!=m.editor.fontCss&&(Za.writeln('<style type="text/css">'),
Za.writeln(m.editor.fontCss),Za.writeln("</style>"));for(var cb=Aa.getCustomFonts(),bb=0;bb<cb.length;bb++){var eb=cb[bb].name,db=cb[bb].url;Graph.isCssFontUrl(db)?Za.writeln('<link rel="stylesheet" href="'+mxUtils.htmlEntities(db)+'" charset="UTF-8" type="text/css">'):(Za.writeln('<style type="text/css">'),Za.writeln('@font-face {\nfont-family: "'+mxUtils.htmlEntities(eb)+'";\nsrc: url("'+mxUtils.htmlEntities(db)+'");\n}'),Za.writeln("</style>"))}};if("undefined"!==typeof MathJax){var ib=La.renderPage;