Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.getPngFileProperties=function(d){var f=1,k=0;if(null!=d){if(d.hasAttribute("scale")){var u=parseFloat(d.getAttribute("scale"));!isNaN(u)&&0<u&&(f=u)}d.hasAttribute("border")&&(u=parseInt(d.getAttribute("border")),!isNaN(u)&&0<u&&(k=u))}return{scale:f,border:k}};EditorUi.prototype.getEmbeddedPng=function(d,f,k,u,z){try{var C=this.editor.graph,F=null!=C.themes&&"darkTheme"==C.defaultThemeName,K=null;if(null!=k&&0<k.length)C=this.createTemporaryGraph(F?C.getDefaultStylesheet():C.getStylesheet()),