Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFileSync.prototype.receiveRemoteChanges=function(b){this.file.ignorePatches(b.c)||(null==this.receivedData?(this.receivedData=[b],window.setTimeout(mxUtils.bind(this,function(){if(this.ui.getCurrentFile()==this.file)if(1==this.receivedData.length)this.doReceiveRemoteChanges(this.receivedData[0].c);else{this.receivedData.sort(function(k,l){return k.id<l.id?-1:k.id>l.id?1:0});for(var e=null,f=0;f<this.receivedData.length;f++){var c=JSON.stringify(this.receivedData[f].c);c!=e&&this.doReceiveRemoteChanges(this.receivedData[f].c);
e=c}}this.receivedData=null}),this.syncReceiveMessageDelay)):this.receivedData.push(b))};