Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(m,z,J,O){null==O&&(O=this.createImageUrlConverter());var T=0,W=J||{};J=mxUtils.bind(this,function(V,Q){V=m.getElementsByTagName(V);for(var X=0;X<V.length;X++)mxUtils.bind(this,function(Z){try{if(null!=Z){var Y=O.convert(Z.getAttribute(Q));if(null!=Y&&"data:"!=Y.substring(0,5)){var aa=W[Y];null==aa?(T++,this.convertImageToDataUri(Y,function(ca){null!=ca&&(W[Y]=ca,Z.setAttribute(Q,ca));T--;0==T&&z(m)})):Z.setAttribute(Q,aa)}else null!=Y&&Z.setAttribute(Q,Y)}}catch(ca){}})(V[X])});J("image",
"xlink:href");J("img","src");0==T&&z(m)};Editor.base64Encode=function(m){for(var z="",J=0,O=m.length,T,W,V;J<O;){T=m.charCodeAt(J++)&255;if(J==O){z+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(T>>2);z+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((T&3)<<4);z+="==";break}W=m.charCodeAt(J++);if(J==O){z+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(T>>2);z+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((T&