Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
0;W<Q.length;W++)Q[W].parentNode.removeChild(Q[W]);M(m);m.style.opacity="0.5"}else{Q=N(q).replies;for(W=0;W<Q.length;W++)v.removeChild(Q[W]);for(W=0;W<C.length;W++)if(C[W]==q){C.splice(W,1);break}A.style.display=0==v.getElementsByTagName("div").length?"block":"none"}},function(W){z(m);b.handleError(W,null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))})})},q.isResolved));d||q.isLocked||0!=G||O(q.isResolved?mxResources.get("reopen"):mxResources.get("resolve"),function(W){function Q(){var V=
W.target;V.innerText="";q.isResolved=!q.isResolved;mxUtils.write(V,q.isResolved?mxResources.get("reopen"):mxResources.get("resolve"));for(var X=q.isResolved?"none":"",Y=N(q).replies,Z=Editor.isDarkMode()?"transparent":q.isResolved?"ghostWhite":"white",ca=0;ca<Y.length;ca++){Y[ca].style.backgroundColor=Z;for(var da=Y[ca].querySelectorAll(".geCommentAction"),ma=0;ma<da.length;ma++)da[ma]!=V.parentNode&&(da[ma].style.display=X);F||(Y[ca].style.display="none")}x()}q.isResolved?T(mxResources.get("reOpened")+