Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
l;window.mxFreehand&&(c.actions.put("insertFreehand",new Action(mxResources.get("freehand")+"...",function(){if(k.isEnabled()){if(null==c.freehandWindow){var p=!mxClient.IS_IE&&!mxClient.IS_IE11;c.freehandWindow=new FreehandWindow(c,document.body.offsetWidth-420,102,176,p?120:84,p)}k.freehand.isDrawing()?k.freehand.stopDrawing():k.freehand.startDrawing();c.freehandWindow.window.setVisible(k.freehand.isDrawing())}},null,null,"X")).isEnabled=function(){return l()&&mxClient.IS_SVG});c.actions.put("exportXml",