Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.updateDiagram=function(c){function e(H){var g=new mxCellOverlay(H.image||p.warningImage,H.tooltip,H.align,H.valign,H.offset);g.addListener(mxEvent.CLICK,function(x,F){n.alert(H.tooltip)});return g}var k=null,n=this;if(null!=c&&0<c.length&&(k=mxUtils.parseXml(c),c=null!=k?k.documentElement:null,null!=c&&"updates"==c.nodeName)){var p=this.editor.graph,t=p.getModel();t.beginUpdate();var y=null;try{for(c=c.firstChild;null!=c;){if("update"==c.nodeName){var A=t.getCell(c.getAttribute("id"));