Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
T.setAttribute("crossorigin","");z.parentNode.insertBefore(T,z)}}}};Editor.trimCssUrl=function(m){return m.replace(RegExp("^[\\s\"']+","g"),"").replace(RegExp("[\\s\"']+$","g"),"")};Editor.GOOGLE_FONTS="https://fonts.googleapis.com/css?family=";Editor.GUID_ALPHABET="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_";Editor.GUID_LENGTH=20;Editor.guid=function(m){m=null!=m?m:Editor.GUID_LENGTH;for(var z=[],J=0;J<m;J++)z.push(Editor.GUID_ALPHABET.charAt(Math.floor(Math.random()*Editor.GUID_ALPHABET.length)));
return z.join("")};Editor.updateStatusInterval=1E4;Editor.prototype.appName="draw.io";Editor.prototype.diagramFileTypes=[{description:"diagramXmlDesc",extension:"drawio",mimeType:"text/xml"},{description:"diagramPngDesc",extension:"png",mimeType:"image/png"},{description:"diagramSvgDesc",extension:"svg",mimeType:"image/svg"},{description:"diagramHtmlDesc",extension:"html",mimeType:"text/html"},{description:"diagramXmlDesc",extension:"xml",mimeType:"text/xml"}];Editor.prototype.libraryFileTypes=[{description:"Library (.drawiolib, .xml)",