Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
N=parseFloat(p[0].getAttribute("height")))}n(I.result,U,N)}catch(y){q(y)}};S.src=I.result};I.onerror=function(G){q(G)}}else q(F)};B.onerror=function(F){q(F)};B.send()};EditorUi.prototype.insertAsPreText=function(d,g,n){var q=this.editor.graph,t=null;q.getModel().beginUpdate();try{t=q.insertVertex(null,null,"<pre>"+d+"</pre>",g,n,1,1,"text;html=1;align=left;verticalAlign=top;"),q.updateCellSize(t,!0)}finally{q.getModel().endUpdate()}return t};EditorUi.prototype.insertTextAt=function(d,g,n,q,t,v,B,