Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
u.style+=c(u.style,e,N,u,G);u.geometry.relative=!0;u.geometry.offset=new mxPoint(5,-12);u.vertex=!0;t.insert(u)}function Wa(u,F,C,t,e,N,r,q){e="transparent"!=u?mxConstants.STYLE_SHAPE+"=mxgraph.gcp2.":mxConstants.STYLE_SHAPE+"=";N.style="rounded=1;absoluteArcSize=1;arcSize=2;verticalAlign=bottom;fillColor=#ffffff;strokeColor=#dddddd;whiteSpace=wrap;";N.style+=c(N.style,r,q,N);N.value=m(r);N.vertex=!0;u=new mxCell(null,new mxGeometry(.5,0,.7*t*F,.7*t*C),e+u+";part=1;dashed=0;connectable=0;html=1;strokeColor=none;shadow=0;");
u.geometry.relative=!0;u.geometry.offset=new mxPoint(-F*t*.35,10+(1-C)*t*.35);u.vertex=!0;u.style+=c(u.style,r,q,u,G);N.insert(u)}function Xc(u,F){return null!=u&&null!=F&&(F==mxConstants.STYLE_ALIGN+"Global"&&(F=mxConstants.STYLE_ALIGN),u.includes(";"+F+"=")||u.substring(0,F.length+1)==F+"=")?!0:!1}function Rd(u,F){function C(t){t=Math.round(parseInt("0x"+t)*F).toString(16);return 1==t.length?"0"+t:t}return"#"+C(u.substr(1,2))+C(u.substr(3,2))+C(u.substr(5,2))}function Ie(u,F,C){var t=g(u),e=t.Properties,