Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.recentCustomFonts[M]=P,x=document.getElementsByTagName("head")[0],null!=F&&("link"==P.elt.nodeName.toLowerCase()?(P.elt.onload=F,P.elt.onerror=F):F()),null!=x&&x.appendChild(P.elt)):null!=F&&F()}else null!=F&&F()}else null!=F&&F();return g};Graph.getFontUrl=function(g,x){g=Graph.customFontElements[g.toLowerCase()];null!=g&&(x=g.url);return x};Graph.processFontAttributes=function(g){g=g.getElementsByTagName("*");for(var x=0;x<g.length;x++){var F=g[x].getAttribute("data-font-src");if(null!=F){var M=