Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M="jpg"}catch(ha){console.log(ha)}I.style+=";image=data:image/"+M+","+O;x()};J.src="data:image/"+E.iType+";base64,"+E.iData;J.onerror=function(){I.style+=";image=data:image/"+E.iType+","+E.iData;x()}};k(0,a)}else a()}catch(n){console.log(n),a()}};m.prototype.addShape=function(g,b,a,c,d){b.parentHeight=d;var f=h.mxgraph.io.vsdx.VsdxShape.getType(b.getShape());if(null!=f&&(function(n,p){return n&&n.equals?n.equals(p):n===p}(f,h.mxgraph.io.vsdx.mxVsdxConstants.TYPE_SHAPE)||function(n,p){return n&&n.equals?