Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
(0<K.length&&(K+="\n"),K+=F);F=new LocalFile(this,"csv"!=d.format&&0<K.length?K:this.emptyDiagramXml,null!=urlParams.title?decodeURIComponent(urlParams.title):this.defaultFilename,!0);F.getHash=function(){return u};this.fileLoaded(F);"csv"==d.format&&this.importCsv(K,mxUtils.bind(this,function(ca){this.editor.undoManager.clear();this.editor.setModified(!1);this.editor.setStatus("")}));if(null!=d.update){var O=null!=d.interval?parseInt(d.interval):6E4,H=null,ka=mxUtils.bind(this,function(){var ca=