Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
t.scrollCellToVisible(t.getSelectionCell())}}}else{Q=function(B){var H=m[B];null==H&&(H=new mxCell(B,new mxGeometry(0,0,80,30),"whiteSpace=wrap;html=1;"),H.vertex=!0,m[B]=H,C.push(H));return H};var m={};C=[];for(A=0;A<n.length;A++)if(";"!=n[A].charAt(0)){var v=n[A].split("->");2<=v.length&&(O=Q(v[0]),J=Q(v[v.length-1]),v=new mxCell(2<v.length?v[1]:"",new mxGeometry),v.edge=!0,O.insertEdge(v,!0),J.insertEdge(v,!1),C.push(v))}if(0<C.length){n=document.createElement("div");n.style.visibility="hidden";