Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxCellEditor.prototype.startEditing=function(x,J){x=this.graph.getStartEditingCell(x,J);C.apply(this,arguments);var Q=this.graph.view.getState(x);this.textarea.className=null!=Q&&1==Q.style.html?"mxCellEditor geContentEditable":"mxCellEditor mxPlainTextEditor";this.codeViewMode=!1;this.switchSelectionState=null;this.graph.setSelectionCell(x);Q=this.graph.getModel().getParent(x);var Y=this.graph.getCellGeometry(x);if(this.graph.getModel().isEdge(Q)&&null!=Y&&Y.relative||this.graph.getModel().isEdge(x))this.textarea.style.outline=
mxClient.IS_IE||mxClient.IS_IE11||mxClient.IS_FF&&mxClient.IS_WIN?"gray dotted 1px":""};var F=mxCellEditor.prototype.installListeners;mxCellEditor.prototype.installListeners=function(x){function J(ea,la){la.originalNode=ea;ea=ea.firstChild;for(var oa=la.firstChild;null!=ea&&null!=oa;)J(ea,oa),ea=ea.nextSibling,oa=oa.nextSibling;return la}function Q(ea,la){if(null!=ea)if(la.originalNode!=ea)Y(ea);else for(ea=ea.firstChild,la=la.firstChild;null!=ea;){var oa=ea.nextSibling;null==la?Y(ea):(Q(ea,la),la=