Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
try{A=u.insertVertex(null,null,"<pre>"+d+"</pre>",f,l,1,1,"text;html=1;align=left;verticalAlign=top;"),u.updateCellSize(A,!0)}finally{u.getModel().endUpdate()}return A};EditorUi.prototype.insertTextAt=function(d,f,l,u,A,B,F,M){B=null!=B?B:!0;F=null!=F?F:!0;if(null!=d)if(Graph.fileSupport&&(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d))this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):this.parseFileData(d.replace(/\s+/g," "),mxUtils.bind(this,function(ca){4==