Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
!0,"1"==urlParams.dev?mxscript("js/orgchart/bridge.min.js",function(){mxscript("js/orgchart/bridge.collections.min.js",function(){mxscript("js/orgchart/OrgChart.Layout.min.js",function(){mxscript("js/orgchart/mxOrgChartLayout.js",k,null,null,null,u)},null,null,null,u)},null,null,null,u)},null,null,null,u):mxscript(DRAWIO_BASE_URL+"/js/orgchart.min.js",k,null,null,null,u))}),onerror)};EditorUi.prototype.importCsv=function(d,f){this.loadOrgChartLayouts(mxUtils.bind(this,function(){this.doImportCsv(d,
f)}))};EditorUi.prototype.doImportCsv=function(d,f){try{var k=d.split("\n"),u=[],z=[],C=[],F={};if(0<k.length){var K={},O=this.editor.graph,H=null,ka=null,fa=null,ca=null,ja=null,ma=null,aa=null,S="whiteSpace=wrap;html=1;",da=null,P=null,V="",l="auto",A="auto",N=!1,X=null,U=null,Z=40,ba=40,ia=100,qa=0,ra=mxUtils.bind(this,function(){null!=f?f(sa):(O.setSelectionCells(sa),O.scrollCellToVisible(O.getSelectionCell()));null!=this.chromelessResize&&window.setTimeout(mxUtils.bind(this,function(){this.chromelessResize(!0)}),