Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.onKeyDown=function(b){var e=this.editor.graph;if(9==b.which&&e.isEnabled()&&!mxEvent.isControlDown(b)){if(e.isEditing())if(mxEvent.isAltDown(b))e.stopEditing(!1);else try{var g=e.cellEditor.isContentEditing()&&e.cellEditor.isTextSelected();if(window.getSelection&&e.cellEditor.isContentEditing()&&!g&&!mxClient.IS_IE&&!mxClient.IS_IE11){var p=window.getSelection(),y=0<p.rangeCount?p.getRangeAt(0).commonAncestorContainer:null;g=null!=y&&("LI"==y.nodeName||null!=y.parentNode&&"LI"==
y.parentNode.nodeName)}g?document.execCommand(mxEvent.isShiftDown(b)?"outdent":"indent",!1,null):mxEvent.isShiftDown(b)?e.stopEditing(!1):e.cellEditor.insertTab(e.cellEditor.isContentEditing()?null:4)}catch(q){}else mxEvent.isAltDown(b)?e.selectParentCell():e.selectCell(!mxEvent.isShiftDown(b));mxEvent.consume(b)}};