Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var N=new Spinner({left:"50%",lines:12,length:8,width:3,radius:5,rotate:0,color:"#000",speed:1,trail:60,shadow:!1,hwaccel:!1,className:"spinner",zIndex:2E9}),P=new Editor,R=null,M=null,p=null,y=!1,C=[],L=null,m=null;this.getSelectedItem=function(){null!=M&&l(M);return M};if(null==g("#mxODPickerCss")){var z=document.head||document.getElementsByTagName("head")[0],J=document.createElement("style");z.appendChild(J);J.type="text/css";J.id="mxODPickerCss";J.appendChild(document.createTextNode(U))}b.innerHTML=