Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.createSvgNode=function(b,e,g,n,y){var q=mxUtils.createXmlDocument(),E=null!=q.createElementNS?q.createElementNS(mxConstants.NS_SVG,"svg"):q.createElement("svg");null!=y&&(null!=E.style?E.style.backgroundColor=y:E.setAttribute("style","background-color:"+y));null==q.createElementNS?(E.setAttribute("xmlns",mxConstants.NS_SVG),E.setAttribute("xmlns:xlink",mxConstants.NS_XLINK)):E.setAttributeNS("http://www.w3.org/2000/xmlns/","xmlns:xlink",mxConstants.NS_XLINK);E.setAttribute("version","1.1");
E.setAttribute("width",g+"px");E.setAttribute("height",n+"px");E.setAttribute("viewBox",b+" "+e+" "+g+" "+n);q.appendChild(E);return E};Graph.htmlToPng=function(b,e,g,n){var y=document.createElement("canvas");y.width=e;y.height=g;var q=document.createElement("img");q.onload=mxUtils.bind(this,function(){y.getContext("2d").drawImage(q,0,0);n(y.toDataURL())});q.src="data:image/svg+xml,"+encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><foreignObject width="100%" height="100%"><div xmlns="http://www.w3.org/1999/xhtml"><style>em{color:red;}</style><em>I</em> lick <span>cheese</span></div></foreignObject></svg>')};