Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
z[K]&&(z[K]=(z[K]||0)+1,n++),C.push(M))}u.setCellStyles(mxConstants.STYLE_IMAGE,null,C);console.log("Removed",n,"image(s) from",C.length,"cell(s): ",[C,z])}finally{u.model.endUpdate()}}));d.actions.addAction("testInspect",mxUtils.bind(this,function(){console.log(d,u.getModel())}));d.actions.addAction("testXmlImageExport",mxUtils.bind(this,function(){var l=new mxImageExport,n=u.getGraphBounds(),z=u.view.scale,C=mxUtils.createXmlDocument(),D=C.createElement("output");C.appendChild(D);C=new mxXmlCanvas2D(D);