Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Ha.substring(Ha.indexOf(",")+1);Sa.style.cursor="pointer";Sa.style.width="100%";Sa.style.height="100%";na.appendChild(Sa);ra=b.createMermaidXml("%% Input: "+Na+"\n"+ra,EditorUi.defaultMermaidConfig,Ha,La,Xa);var Ta="<mxfile><diagram>"+Graph.compress(ra)+"</diagram></mxfile>";if(Ia||"undefined"===typeof mxMermaidToDrawio)ba=ma=ra;ra=m.cloneNode(!0);na.appendChild(ra);Ha=function(Pa){R=null!=b.sidebar.tooltip&&"none"!=b.sidebar.tooltip.style.display};La=function(Pa){R||A(Ta,mxEvent.getClientX(Pa),mxEvent.getClientY(Pa),