Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
v.getAttribute("placeholders"));null!=F&&mxEvent.isShiftDown(F)||k.setAttribute("label",q.convertValueToString(f));W.setValue(f,k)}F=null!=K?K:F;var W=q.getModel();if(q.isEnabled()&&!q.isSelectionEmpty()&&null!=n.copiedValue){W.beginUpdate();try{var d=q.getEditableCells(q.getSelectionCells());if(0==d.length)R(W.getRoot(),n.copiedValue);else for(K=0;K<d.length;K++)R(d[K],n.copiedValue)}finally{W.endUpdate()}}},null,null,"Alt+Shift+E");this.addAction("delete",function(F,K){F=null!=K?K:F;null!=F&&mxEvent.isShiftDown(F)?