Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
K+8,U=(B.y+N.lastCursor.y)*K-12,W=N.cursor.getElementsByTagName("img")[0];T?(mxUtils.setPrefixedStyle(N.cursor.style,"transition","all 900ms ease-out"),mxUtils.setPrefixedStyle(W.style,"transition","all 900ms ease-out"),window.setTimeout(m,0)):(mxUtils.setPrefixedStyle(N.cursor.style,"transition",null),mxUtils.setPrefixedStyle(W.style,"transition",null),m())}}function x(N,T){try{var m=function(){if(null==g[K]){var Z=A[K];null==Z&&(Z=M%d.length,A[K]=Z,M++);var ca=d[Z];Z=11<Z?"black":"white";g[K]={cursor:document.createElement("div"),
color:ca,selection:{}};u[T]=K;R=g[K].cursor;R.style.pointerEvents="none";R.style.position="absolute";R.style.display="none";R.style.opacity="0.9";var da=document.createElement("img");mxUtils.setPrefixedStyle(da.style,"transform","rotate(-45deg)translateX(-14px)");da.setAttribute("src",Graph.createSvgImage(8,12,'<path d="M 4 0 L 8 12 L 4 10 L 0 12 Z" stroke="'+ca+'" fill="'+ca+'"/>').src);da.style.width="10px";R.appendChild(da);da=document.createElement("div");da.style.backgroundColor=ca;da.style.color=
Z;da.style.fontSize="9pt";da.style.padding="3px 7px";da.style.marginTop="8px";da.style.borderRadius="10px";da.style.maxWidth="100px";da.style.overflow="hidden";da.style.textOverflow="ellipsis";da.style.whiteSpace="nowrap";mxUtils.write(da,B);R.appendChild(da);b.diagramContainer.appendChild(R)}else R=g[K].cursor;U=g[K].selection};if(!q){N=JSON.parse(N);null!=N.bytes&&(N=e.stringToObject(N.bytes));C&&"cursor"!=N.type&&EditorUi.debug("P2PCollab: msg received",[N]);if(null!=T){if(N.from==H||t[N.from]>=