Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0,"1"==urlParams.dev?mxscript("js/orgchart/bridge.min.js",function(){mxscript("js/orgchart/bridge.collections.min.js",function(){mxscript("js/orgchart/OrgChart.Layout.min.js",function(){mxscript("js/orgchart/mxOrgChartLayout.js",n,null,null,null,t)},null,null,null,t)},null,null,null,t)},null,null,null,t):mxscript(DRAWIO_BASE_URL+"/js/orgchart.min.js",n,null,null,null,t))}),onerror)};EditorUi.prototype.importCsv=function(d,g){this.loadOrgChartLayouts(mxUtils.bind(this,function(){this.doImportCsv(d,
g)}))};EditorUi.prototype.doImportCsv=function(d,g){try{var n=d.split("\n"),t=[],u=[],v=[],A={};if(0<n.length){var H={},L=this.editor.graph,F=null,S=null,p=null,q=null,C=null,J=null,G=null,P="whiteSpace=wrap;html=1;",O=null,N=null,T="",m="auto",B="auto",K=!1,R=null,U=null,W=40,Q=40,V=100,X=0,Y=mxUtils.bind(this,function(){null!=g?g(Ua):(L.setSelectionCells(Ua),L.scrollCellToVisible(L.getSelectionCell()));null!=this.chromelessResize&&window.setTimeout(mxUtils.bind(this,function(){this.chromelessResize(!0)}),