Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
{replAllMrk:t,replAllPos:q};A.isCellEditable(O)&&(A.model.setValue(O,M(T,n,I.value,q-n.length,A.getCurrentCellStyle(O))),z++)}L!=b.currentPage&&b.editor.graph.model.execute(new SelectPage(b,L));mxUtils.write(R,mxResources.get("matchesRepl",[z]))}catch(V){b.handleError(V)}finally{A.getModel().endUpdate(),b.editor.graph.setSelectionCells(m),b.editor.graph.rendering=!0}t++});C.setAttribute("title",mxResources.get("replaceAll"));C.style.float="none";C.style.width="120px";C.style.marginTop="6px";C.style.marginLeft=