Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(h){(function(y){(function(A){(function(B){var m=function(){function g(b){this.themeIndex=-1;this.themeVariant=0;this.baseColors={};this.variantsColors=function(a){var c=function(d){if(0!=d.length){for(var f=[],k=0;k<d[0];k++)f.push(c(d.slice(1)));return f}};return c(a)}([4,7]);this.isMonotoneVariant=Array(4);this.defaultClr=new h.mxgraph.io.vsdx.theme.Color(255,255,255);this.defaultLineClr=new h.mxgraph.io.vsdx.theme.Color(0,0,0);this.defaultLineStyle=new h.mxgraph.io.vsdx.theme.LineStyle;this.fillStyles=