Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
xa),sa,this);this.fireEvent(new mxEventObject(mxEvent.CELLS_ADDED,"cells",sa))}finally{X.endUpdate()}return la};Graph.prototype.insertImage=function(x,L,P){if(null!=x&&null!=this.cellEditor.textarea){for(var X=this.cellEditor.textarea.getElementsByTagName("img"),ea=[],la=0;la<X.length;la++)ea.push(X[la]);document.execCommand("insertimage",!1,x);x=this.cellEditor.textarea.getElementsByTagName("img");if(x.length==ea.length+1)for(la=x.length-1;0<=la;la--)if(0==la||x[la]!=ea[la-1]){x[la].setAttribute("width",