Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.GUID_ALPHABET="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_";Editor.GUID_LENGTH=20;Editor.guid=function(l){l=null!=l?l:Editor.GUID_LENGTH;for(var A=[],N=0;N<l;N++)A.push(Editor.GUID_ALPHABET.charAt(Math.floor(Math.random()*Editor.GUID_ALPHABET.length)));return A.join("")};Editor.updateStatusInterval=1E4;Editor.prototype.appName="draw.io";Editor.prototype.diagramFileTypes=[{description:"diagramXmlDesc",extension:"drawio",mimeType:"text/xml"},{description:"diagramPngDesc",