Cross-Site Scripting Vulnerability in Apache ECharts Affecting Tooltip Rendering

CVE-2026-45249

What is CVE-2026-45249?

A cross-site scripting (XSS) vulnerability exists in Apache ECharts specifically related to the tooltip rendering of the Lines series. If a custom tooltip.formatter is not specified and the data for the Lines series includes raw HTML in series.data[i].name, this can be rendered unsafely through innerHTML, potentially exposing users to script execution when the tooltip is displayed. This flaw compromises the usual HTML escaping behavior of built-in tooltip formatters. To mitigate this risk, it is recommended that users upgrade to version 6.1.0 or later, where this issue has been addressed.

References