Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
g&&g(N)}}),null,null,null,mxUtils.bind(this,function(S){null!=g&&g(S)}),null,null,q,null,v.shadowVisible,null,v,t,null,null,null,"diagram",null)}catch(S){null!=g&&g(S)}};EditorUi.prototype.getEmbeddedSvg=function(d,g,n,q,t,v,B,F,I,G,S,U,N){F=null!=F?F:!0;S=null!=S?S:0;B=null!=I?I:g.background;B==mxConstants.NONE&&(B=null);v=g.getSvg(B,G,S,null,null,v,null,null,null,g.shadowVisible||U,null,N,"diagram");(g.shadowVisible||U)&&g.addSvgShadow(v,null,null,0==S);null!=d&&v.setAttribute("content",d);null!=
n&&v.setAttribute("resource",n);var P=mxUtils.bind(this,function(R){R=(q?"":Graph.xmlDeclaration+"\n"+Graph.svgFileComment+"\n"+Graph.svgDoctype+"\n")+mxUtils.getXml(R);null!=t&&t(R);return R});g.mathEnabled&&this.editor.addMathCss(v);if(null!=t)this.embedFonts(v,mxUtils.bind(this,function(R){F?this.editor.convertImages(R,mxUtils.bind(this,function(M){P(M)})):P(R)}));else return P(v)};EditorUi.prototype.embedFonts=function(d,g){this.editor.loadFonts(mxUtils.bind(this,function(){try{null!=this.editor.resolvedFontCss&&