Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
p=null;q.getModel().beginUpdate();try{p=q.insertVertex(null,null,"<pre>"+c+"</pre>",e,g,1,1,"text;html=1;align=left;verticalAlign=top;"),q.updateCellSize(p,!0)}finally{q.getModel().endUpdate()}return p};EditorUi.prototype.insertTextAt=function(c,e,g,q,p,t,x,B){t=null!=t?t:!0;x=null!=x?x:!0;if(null!=c)if(Graph.fileSupport&&(new XMLHttpRequest).upload&&this.isRemoteFileFormat(c))this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):this.parseFileData(c.replace(/\s+/g,