Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
p.pasteCounter=0);var y=p.pasteCounter*p.gridSize;if(k||this.isCompatibleString(c))t=this.importXml(c,y,y),p.setSelectionCells(t);else if(e&&1==p.getSelectionCount()){y=p.getStartEditingCell(p.getSelectionCell(),n);if(/\.(gif|jpg|jpeg|tiff|png|svg)$/i.test(c)&&"image"==p.getCurrentCellStyle(y)[mxConstants.STYLE_SHAPE])p.setCellStyles(mxConstants.STYLE_IMAGE,c,[y]);else{p.model.beginUpdate();try{p.labelChanged(y,c),Graph.isLink(c)&&p.setLinkForCell(y,c)}finally{p.model.endUpdate()}}p.setSelectionCell(y)}else t=
p.getInsertPoint(),p.isMouseInsertPoint()&&(y=0,p.lastPasteXml==c&&0<p.pasteCounter&&p.pasteCounter--),t=this.insertTextAt(c,t.x+y,t.y+y,!0),p.setSelectionCells(t);p.isSelectionEmpty()||(p.scrollCellToVisible(p.getSelectionCell()),null!=this.hoverIcons&&this.hoverIcons.update(p.view.getState(p.getSelectionCell())));return t};EditorUi.prototype.pasteCells=function(c,e,k,n){if(!mxEvent.isConsumed(c)){var p=e,t=!1;if(k&&null!=c.clipboardData&&c.clipboardData.getData){var y=c.clipboardData.getData("text/plain"),