Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.generateMermaidImage(da,null,mxUtils.bind(this,function(ca,ia,ma){this.tryAndHandle(mxUtils.bind(this,function(){B.clear()&&(EditorUi.debug("EditorUi.generateOpenAiMermaidDiagram","\nprompt:",d,"\nresponse:",ja,"\nresult:",da),this.spinner.stop(),f(da,ca,ia,ma))}),M)}),M,mxUtils.bind(this,function(ca){3>u++?B.clear()&&(this.spinner.stop(),A()):M(ca)}))}),M);else{var H={message:mxResources.get("error")+" "+O.getStatus()};try{H=JSON.parse(O.getText()),H=H.error}catch(ja){}M(H)}}),M)}),l)});A()};