Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(Va){try{null!=Va&&this.addFontCss(Aa,Va),this.loadFonts(za)}catch(La){null!=V&&V(La)}}))}catch(Va){null!=V&&V(Va)}}),M,pa)}catch(Aa){null!=V&&V(Aa)}};Editor.crcTable=[];for(var y=0;256>y;y++)for(var q=y,E=0;8>E;E++)q=1==(q&1)?3988292384^q>>>1:q>>>1,Editor.crcTable[y]=q;Editor.updateCRC=function(m,C,M,ba){for(var V=0;V<ba;V++)m=Editor.crcTable[(m^C.charCodeAt(M+V))&255]^m>>>8;return m};Editor.crc32=function(m){for(var C=-1,M=0;M<m.length;M++)C=C>>>8^Editor.crcTable[(C^m.charCodeAt(M))&255];
return(C^-1)>>>0};Editor.writeGraphModelToPng=function(m,C,M,ba,V){function Z(pa,wa){var Da=qa;qa+=wa;return pa.substring(Da,qa)}function aa(pa){pa=Z(pa,4);return pa.charCodeAt(3)+(pa.charCodeAt(2)<<8)+(pa.charCodeAt(1)<<16)+(pa.charCodeAt(0)<<24)}function ka(pa){return String.fromCharCode(pa>>24&255,pa>>16&255,pa>>8&255,pa&255)}m=m.substring(m.indexOf(",")+1);m=window.atob?atob(m):Base64.decode(m,!0);var qa=0;if(Z(m,8)!=String.fromCharCode(137)+"PNG"+String.fromCharCode(13,10,26,10))null!=V&&V();