Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.addLinkSection=function(d,g){function n(){var F=document.createElement("div");F.style.width="100%";F.style.height="100%";F.style.boxSizing="border-box";null!=v&&v!=mxConstants.NONE?(F.style.border="1px solid black",F.style.backgroundColor=v):(F.style.backgroundPosition="center center",F.style.backgroundRepeat="no-repeat",F.style.backgroundImage="url('"+Dialog.prototype.closeImage+"')");B.innerText="";B.appendChild(F)}mxUtils.write(d,mxResources.get("links")+":");var q=document.createElement("select");