Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Math.round(this.bounds.y)+"px";mxUtils.setPrefixedStyle(this.textarea.style,"transform","scale("+Q+","+Q+")")}else this.textarea.style.height="",this.textarea.style.overflow="",M.apply(this,arguments)};mxCellEditorGetInitialValue=mxCellEditor.prototype.getInitialValue;mxCellEditor.prototype.getInitialValue=function(v,N){if("0"==mxUtils.getValue(v.style,"html","0"))return mxCellEditorGetInitialValue.apply(this,arguments);var Q=this.graph.getEditingValue(v.cell,N);"1"==mxUtils.getValue(v.style,"nl2Br",
"1")&&(Q=Q.replace(/\n/g,"<br/>"));return Q=Graph.sanitizeHtml(Q,!0)};mxCellEditorGetCurrentValue=mxCellEditor.prototype.getCurrentValue;mxCellEditor.prototype.getCurrentValue=function(v){if("0"==mxUtils.getValue(v.style,"html","0"))return mxCellEditorGetCurrentValue.apply(this,arguments);var N=Graph.sanitizeHtml(this.textarea.innerHTML,!0);return N="1"==mxUtils.getValue(v.style,"nl2Br","1")?N.replace(/\r\n/g,"<br/>").replace(/\n/g,"<br/>"):N.replace(/\r\n/g,"").replace(/\n/g,"")};var O=mxCellEditor.prototype.stopEditing;