Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
{replAllMrk:p,replAllPos:n};E.isCellEditable(M)&&(E.model.setValue(M,J(P,k,G.value,n-k.length,E.getCurrentCellStyle(M))),x++)}H!=b.currentPage&&b.editor.graph.model.execute(new SelectPage(b,H));mxUtils.write(Q,mxResources.get("matchesRepl",[x]))}catch(W){b.handleError(W)}finally{E.getModel().endUpdate(),b.editor.graph.setSelectionCells(g),b.editor.graph.rendering=!0}p++});B.setAttribute("title",mxResources.get("replaceAll"));B.style.float="none";B.style.width="120px";B.style.marginTop="6px";B.style.marginLeft=