Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.getDataForCells=function(b){for(var e=[],g=0;g<b.length;g++){var n=null!=b[g].value?b[g].value.attributes:null,y={};y.id=b[g].id;if(null!=n)for(var q=0;q<n.length;q++)y[n[q].nodeName]=n[q].nodeValue;else y.label=this.convertValueToString(b[g]);e.push(y)}return e};