Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.highlightCells=function(m,z,J,O){for(var T=0;T<m.length;T++)this.highlightCell(m[T],z,J,O)};Graph.prototype.highlightCell=function(m,z,J,O,T){z=null!=z?z:mxConstants.DEFAULT_VALID_COLOR;J=null!=J?J:1E3;m=this.view.getState(m);var W=null;null!=m&&(T=null!=T?T:4,T=Math.max(T+1,mxUtils.getValue(m.style,mxConstants.STYLE_STROKEWIDTH,1)+T),W=new mxCellHighlight(this,z,T,!1),null!=O&&(W.opacity=O),W.highlight(m),window.setTimeout(function(){null!=W.shape&&(mxUtils.setPrefixedStyle(W.shape.node.style,