Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!0,"1"==urlParams.dev?mxscript("js/orgchart/bridge.min.js",function(){mxscript("js/orgchart/bridge.collections.min.js",function(){mxscript("js/orgchart/OrgChart.Layout.min.js",function(){mxscript("js/orgchart/mxOrgChartLayout.js",g,null,null,null,q)},null,null,null,q)},null,null,null,q)},null,null,null,q):mxscript(DRAWIO_BASE_URL+"/js/orgchart.min.js",g,null,null,null,q))}),onerror)};EditorUi.prototype.importCsv=function(c,e){this.loadOrgChartLayouts(mxUtils.bind(this,function(){this.doImportCsv(c,
e)}))};EditorUi.prototype.doImportCsv=function(c,e){try{var g=c.split("\n"),q=[],p=[],t=[],x={};if(0<g.length){var B={},I=this.editor.graph,A=null,S=null,l=null,n=null,z=null,C=null,D=null,M="whiteSpace=wrap;html=1;",K=null,O=null,V="",k="auto",y="auto",G=!1,P=null,Q=null,U=40,T=40,W=100,X=0,Y=mxUtils.bind(this,function(){null!=e?e(Ua):(I.setSelectionCells(Ua),I.scrollCellToVisible(I.getSelectionCell()));null!=this.chromelessResize&&window.setTimeout(mxUtils.bind(this,function(){this.chromelessResize(!0)}),