Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
wa),sa,this);this.fireEvent(new mxEventObject(mxEvent.CELLS_ADDED,"cells",sa))}finally{Y.endUpdate()}return la};Graph.prototype.insertImage=function(x,J,Q){if(null!=x&&null!=this.cellEditor.textarea){for(var Y=this.cellEditor.textarea.getElementsByTagName("img"),ea=[],la=0;la<Y.length;la++)ea.push(Y[la]);document.execCommand("insertimage",!1,x);x=this.cellEditor.textarea.getElementsByTagName("img");if(x.length==ea.length+1)for(la=x.length-1;0<=la;la--)if(0==la||x[la]!=ea[la-1]){x[la].setAttribute("width",