Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxStencilRegistry.loadStencilSet=function(b,e,g,n){var y=mxStencilRegistry.packages[b];if(null!=g&&g||null==y){var q=!1;if(null==y)try{if(n){mxStencilRegistry.loadStencil(b,mxUtils.bind(this,function(E){null!=E&&null!=E.documentElement&&(mxStencilRegistry.packages[b]=E,q=!0,mxStencilRegistry.parseStencilSet(E.documentElement,e,q))}));return}y=mxStencilRegistry.loadStencil(b);mxStencilRegistry.packages[b]=y;q=!0}catch(E){null!=window.console&&console.log("error in loadStencilSet:",b,E)}null!=y&&null!=
y.documentElement&&mxStencilRegistry.parseStencilSet(y.documentElement,e,q)}};mxStencilRegistry.loadStencil=function(b,e){if(null!=e)mxUtils.get(b,mxUtils.bind(this,function(g){e(200<=g.getStatus()&&299>=g.getStatus()?g.getXml():null)}),mxUtils.bind(this,function(g){e(null)}));else return mxUtils.load(b).getXml()};mxStencilRegistry.parseStencilSets=function(b){for(var e=0;e<b.length;e++)mxStencilRegistry.parseStencilSet(mxUtils.parseXml(b[e]).documentElement)};