Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
y.createTemporaryGraph=function(){var V=R.apply(this,arguments);V.getImageFromBundles=function(d){return L.getImageUrl(d)};return V};this.graphConfig.move&&(S.isMoveCellsEvent=function(V){return!0});mxUtils.setPrefixedStyle(G.style,"border-radius","4px");G.style.position="fixed";GraphViewer.resizeSensorEnabled=!1;document.body.style.overflow="hidden";this.addClickHandler(S,y);window.setTimeout(mxUtils.bind(this,function(){try{mxEvent.addListener(e,"click",function(){y.destroy()}),G.style.outline=