Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A.appendChild(C);var J=document.createElement("div");J.style.marginTop="10px";if(l){var G=function(T,m,B,K,R){if(null==R||"1"!=R.html)return K=T.toLowerCase().indexOf(m,K),0>K?T:T.substr(0,K)+B+T.substr(K+m.length);var U=T;m=mxUtils.htmlEntities(m);R=[];var W=-1;for(T=T.replace(/<br>/ig,"\n");-1<(W=T.indexOf("<",W+1));)R.push(W);W=T.match(/<[^>]*>/g);T=T.replace(/<[^>]*>/g,"");K=T.toLowerCase().indexOf(m,K);if(0>K)return U;U=K+m.length;B=mxUtils.htmlEntities(B);T=T.substr(0,K)+B+T.substr(U);for(var Q=
0,V=0;V<R.length;V++){if(R[V]-Q<K)T=T.substr(0,R[V])+W[V]+T.substr(R[V]);else{var X=R[V]-Q<U?K+Q:R[V]+(B.length-m.length);T=T.substr(0,X)+W[V]+T.substr(X)}Q+=W[V].length}return T.replace(/\n/g,"<br>")},P=mxUtils.button(mxResources.get("replFind"),function(){try{if(null!=n&&null!=I){var T=I.cell,m=z.getLabel(T);z.isCellEditable(T)&&z.model.setValue(T,G(m,n,L.value,t-n.length,z.getCurrentCellStyle(T)));H.style.backgroundColor=E(!1,!0)?"":Editor.isDarkMode()?"#ff0000":"#ffcfcf"}}catch(B){b.handleError(B)}});