Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.addLanguageMenu=function(b,e,f){var c=null;null!=this.menus.get("language")&&(c=document.createElement("div"),c.setAttribute("title",mxResources.get("language")),c.className="atlas"!=Editor.currentTheme?"geIcon geAdaptiveAsset":"",c.style.backgroundImage="url("+Editor.globeImage+")",c.style.backgroundPosition="right center",c.style.backgroundRepeat="no-repeat",c.style.backgroundSize="19px 19px",c.style.width="19px",c.style.height="19px",mxUtils.setOpacity(c,40),c.style.position="absolute",
c.style.cursor="pointer",c.style.bottom="20px",c.style.right=null!=f?f:"22px",e&&(c.style.direction="rtl",c.style.textAlign="right",c.style.right=null!=f?f:"24px",e=document.createElement("span"),e.style.display="inline-block",e.style.fontSize="12px",e.style.margin="2px 24px 0 0",e.style.userSelect="none",mxUtils.write(e,mxResources.get("language")),c.appendChild(e),e.className="atlas"!=Editor.currentTheme?"geAdaptiveAsset":""),mxEvent.addListener(c,"click",mxUtils.bind(this,function(k){this.editor.graph.popupMenuHandler.hideMenu();
var l=new mxPopupMenu(this.menus.get("language").funct);l.div.className+=" geMenubarMenu";l.smartSeparators=!0;l.showDisabled=!0;l.autoExpand=!0;l.hideMenu=mxUtils.bind(this,function(){mxPopupMenu.prototype.hideMenu.apply(l,arguments);l.destroy()});var u=mxUtils.getOffset(c);l.popup(u.x,u.y+c.offsetHeight,null,k);this.setCurrentMenu(l)})),b.appendChild(c));return c};