Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
X[ba]();null!=ra&&(qa=qa.concat(ra))}}finally{V.getModel().endUpdate()}}C(qa)}}),Z=0;Z<A;Z++)mxUtils.bind(this,function(ba){var ia=d[ba];if(null!=ia){var qa=new FileReader;qa.onload=mxUtils.bind(this,function(ra){if(null==F||F(ia))try{if("image/"==ia.type.substring(0,6))if("image/svg"==ia.type.substring(0,9)){var pa=Graph.clipSvgDataUri(ra.target.result),xa=pa.indexOf(","),Ca=decodeURIComponent(escape(atob(pa.substring(xa+1)))),Aa=mxUtils.parseXml(Ca),za=Aa.getElementsByTagName("svg");if(0<za.length){var Ma=