Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
try{u.labelChanged(A,d),Graph.isLink(d)&&u.setLinkForCell(A,d)}finally{u.model.endUpdate()}}u.setSelectionCell(A)}else v=u.getInsertPoint(),u.isMouseInsertPoint()&&(A=0,u.lastPasteXml==d&&0<u.pasteCounter&&u.pasteCounter--),v=this.insertTextAt(d,v.x+A,v.y+A,!0),u.setSelectionCells(v);u.isSelectionEmpty()||(u.scrollCellToVisible(u.getSelectionCell()),null!=this.hoverIcons&&this.hoverIcons.update(u.view.getState(u.getSelectionCell())));return v};EditorUi.prototype.pasteCells=function(d,g,n,t){if(!mxEvent.isConsumed(d)){var u=