Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
N=parseFloat(m[0].getAttribute("height")))}k(G.result,S,N)}catch(v){n(v)}};V.src=G.result};G.onerror=function(C){n(C)}}else n(A)};y.onerror=function(A){n(A)};y.send()};EditorUi.prototype.insertAsPreText=function(c,e,k){var n=this.editor.graph,p=null;n.getModel().beginUpdate();try{p=n.insertVertex(null,null,"<pre>"+c+"</pre>",e,k,1,1,"text;html=1;align=left;verticalAlign=top;"),n.updateCellSize(p,!0)}finally{n.getModel().endUpdate()}return p};EditorUi.prototype.insertTextAt=function(c,e,k,n,p,t,y,