Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
try{p.labelChanged(x,c),Graph.isLink(c)&&p.setLinkForCell(x,c)}finally{p.model.endUpdate()}}p.setSelectionCell(x)}else t=p.getInsertPoint(),p.isMouseInsertPoint()&&(x=0,p.lastPasteXml==c&&0<p.pasteCounter&&p.pasteCounter--),t=this.insertTextAt(c,t.x+x,t.y+x,!0),p.setSelectionCells(t);p.isSelectionEmpty()||(p.scrollCellToVisible(p.getSelectionCell()),null!=this.hoverIcons&&this.hoverIcons.update(p.view.getState(p.getSelectionCell())));return t};EditorUi.prototype.pasteCells=function(c,e,g,q){if(!mxEvent.isConsumed(c)){var p=