Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
z.pasteCounter=0);var F=z.pasteCounter*z.gridSize;if(k||this.isCompatibleString(d))C=this.importXml(d,F,F),z.setSelectionCells(C);else if(f&&1==z.getSelectionCount()){F=z.getStartEditingCell(z.getSelectionCell(),u);if(/\.(gif|jpg|jpeg|tiff|png|svg)$/i.test(d)&&"image"==z.getCurrentCellStyle(F)[mxConstants.STYLE_SHAPE])z.setCellStyles(mxConstants.STYLE_IMAGE,d,[F]);else{z.model.beginUpdate();try{z.labelChanged(F,d),Graph.isLink(d)&&z.setLinkForCell(F,d)}finally{z.model.endUpdate()}}z.setSelectionCell(F)}else C=
z.getInsertPoint(),z.isMouseInsertPoint()&&(F=0,z.lastPasteXml==d&&0<z.pasteCounter&&z.pasteCounter--),C=this.insertTextAt(d,C.x+F,C.y+F,!0),z.setSelectionCells(C);z.isSelectionEmpty()||(z.scrollCellToVisible(z.getSelectionCell()),null!=this.hoverIcons&&this.hoverIcons.update(z.view.getState(z.getSelectionCell())));return C};EditorUi.prototype.pasteCells=function(d,f,k,u){if(!mxEvent.isConsumed(d)){var z=f,C=!1;if(k&&null!=d.clipboardData&&d.clipboardData.getData){var F=d.clipboardData.getData("text/plain"),