Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c+";"))}}),mxUtils.bind(this,function(){var n=null;I.getModel().beginUpdate();try{n=I.insertVertex(I.getDefaultParent(),null,c,I.snap(e),I.snap(g),1,1,"text;"+(q?"html=1;":"")),I.updateCellSize(n),I.fireEvent(new mxEventObject("textInserted","cells",[n]))}finally{I.getModel().endUpdate()}I.setSelectionCell(n)}))}else{c=Graph.zapGremlins(mxUtils.trim(c));if(this.isCompatibleString(c))return this.importXml(c,e,g,t,null,B);if(0<c.length)if(this.isLucidChartData(c))this.convertLucidChart(c,mxUtils.bind(this,