Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Fa;Ua<$a;Ua+=Q)Ea.drawImage(sa,ua/ia,Ua/ia);Va()}catch(Ra){null!=U&&U(Ra)}};sa.onerror=function(ua){null!=U&&U(ua)};sa.src=J}else Va()}catch(ua){null!=U&&U(ua)}});Ba.onerror=function(Va){null!=U&&U(Va)};ra&&this.graph.addSvgShadow(Da);this.graph.mathEnabled&&this.addMathCss(Da);var ya=mxUtils.bind(this,function(){try{null!=this.resolvedFontCss&&this.addFontCss(Da,this.resolvedFontCss),Ba.src=Editor.createSvgDataUri(mxUtils.getXml(Da))}catch(Va){null!=U&&U(Va)}});this.embedExtFonts(mxUtils.bind(this,