Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.dblClick=function(x,J){this.isEnabled()&&(J=this.insertTextForEvent(x,J),mxGraph.prototype.dblClick.call(this,x,J))};Graph.prototype.insertTextForEvent=function(x,J){var Q=mxUtils.convertPoint(this.container,mxEvent.getClientX(x),mxEvent.getClientY(x));if(null!=x&&!this.model.isVertex(J)){var Y=this.model.isEdge(J)?this.view.getState(J):null,ea=mxEvent.getSource(x);this.firstClickState!=Y||this.firstClickSource!=ea||null!=Y&&null!=Y.text&&null!=Y.text.node&&null!=Y.text.boundingBox&&