Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
E.setAttribute("width",g+"px");E.setAttribute("height",n+"px");E.setAttribute("viewBox",b+" "+e+" "+g+" "+n);q.appendChild(E);return E};Graph.htmlToPng=function(b,e,g,n){var y=document.createElement("canvas");y.width=e;y.height=g;var q=document.createElement("img");q.onload=mxUtils.bind(this,function(){y.getContext("2d").drawImage(q,0,0);n(y.toDataURL())});q.src="data:image/svg+xml,"+encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><foreignObject width="100%" height="100%"><div xmlns="http://www.w3.org/1999/xhtml"><style>em{color:red;}</style><em>I</em> lick <span>cheese</span></div></foreignObject></svg>')};