Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(d=c)&&d.equals?d.equals("a:extLst"):"a:extLst"===d;d?3===a.length&&(0>this.themeIndex&&this.extractThemeIndex(a[0]),this.addBkgndColor(a[1]),this.addVariantColors(a[2])):(c=c.substring(2),0<a.length&&this.addBasicColor(c,a[0]))}b=b.nextSibling}};g.prototype.addVariantColors=function(b){b=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectFirstChildElement(b);if(null!=b){b=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildElements(b);for(var a=0,c=0;c<b.length;c++){var d=b[c];this.addVariantColorsSet(a++,d)}}};g.prototype.addVariantColorsSet=