Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
l,null,null,null,u)},null,null,null,u)},null,null,null,u)},null,null,null,u):mxscript(DRAWIO_BASE_URL+"/js/orgchart.min.js",l,null,null,null,u))}),onerror)};EditorUi.prototype.importCsv=function(d,f){this.loadOrgChartLayouts(mxUtils.bind(this,function(){this.doImportCsv(d,f)}))};EditorUi.prototype.doImportCsv=function(d,f){try{var l=d.split("\n"),u=[],A=[],B=[],F={};if(0<l.length){var M={},O=this.editor.graph,H=null,ja=null,da=null,ca=null,ia=null,ma=null,aa=null,la="whiteSpace=wrap;html=1;",X=null,