Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
k.setAttribute("src","data:"+d+";base64,"+I);k.style.position="absolute";k.style.top="70px";k.style.right="100px";k.style.maxWidth="120px";k.style.maxHeight="80px";mxUtils.setPrefixedStyle(k.style,"transform","translate(50%,-50%)");l.appendChild(k);mxClient.IS_FF||"image/png"!=d||null==navigator.clipboard||"function"!==typeof window.ClipboardItem||(n=mxUtils.button(mxResources.get("copy"),function(N){N=b.base64ToBlob(I,"image/png");N=new ClipboardItem({"image/png":N,"text/html":new Blob(['<img src="data:'+
d+";base64,"+I+'">'],{type:"text/html"})});navigator.clipboard.write([N]).then(mxUtils.bind(this,function(){b.alert(mxResources.get("copiedToClipboard"))}))["catch"](mxUtils.bind(this,function(P){b.handleError(P)}))}),n.style.marginTop="6px",n.className="geBtn");E&&Editor.popupsAllowed&&(k.style.cursor="pointer",mxEvent.addGestureListeners(k,null,null,function(N){mxEvent.isPopupTrigger(N)||v("_blank")}))}mxUtils.br(l);var G=document.createElement("div");G.style.textAlign="center";var S=0;G.style.marginTop=