Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.currentTheme&&"min"!=Editor.currentTheme||this.addMenuItems(m,["-","outline","fullscreen"],v)});E=this.get("layout");var k=E.funct;E.funct=function(m,v){k.apply(this,arguments);m.addItem(mxResources.get("orgChart"),null,function(){var B=null,H=20,g=20,x=function(){"undefined"!==typeof mxOrgChartLayout&&null!=B&&d.tryAndHandle(mxUtils.bind(this,function(){var Z=d.editor.graph,Y=new mxOrgChartLayout(Z,B,H,g),ba=Z.getDefaultParent();1<Z.model.getChildCount(Z.getSelectionCell())&&(ba=Z.getSelectionCell());
Y.execute(ba)}))},F=document.createElement("div"),M=document.createElement("div");M.style.marginTop="6px";M.style.display="inline-block";M.style.width="140px";mxUtils.write(M,mxResources.get("orgChartType")+": ");F.appendChild(M);var P=document.createElement("select");P.style.width="200px";P.style.boxSizing="border-box";M=[mxResources.get("linear"),mxResources.get("hanger2"),mxResources.get("hanger4"),mxResources.get("fishbone1"),mxResources.get("fishbone2"),mxResources.get("1ColumnLeft"),mxResources.get("1ColumnRight"),