CVE-2026-45249
Received Received - Intake
XSS in Apache ECharts Lines Series Tooltip

Publication date: 2026-05-25

Last updated on: 2026-05-25

Assigner: Apache Software Foundation

Description
A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic. This issue affects Apache ECharts: from before 6.1.0. In versions prior to 6.1.0, if both Lines seriesΒ and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can beΒ rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention andΒ may unexpectedly lead to script execution when tooltips are displayed. Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-25
Last Modified
2026-05-25
Generated
2026-05-26
AI Q&A
2026-05-26
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache echarts to 6.1.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a cross-site scripting (XSS) issue found in Apache ECharts versions before 6.1.0. It occurs in the Lines series tooltip rendering logic when both Lines series and tooltip are used without a user-specified tooltip.formatter, and series.data[i].name contains raw HTML. In this case, the raw HTML string in series.data[i].name is rendered directly into the tooltip content using innerHTML without proper escaping, which can lead to unexpected script execution when tooltips are displayed.


How can this vulnerability impact me? :

This vulnerability can allow an attacker to execute arbitrary scripts in the context of the affected application by injecting malicious HTML or JavaScript into the series.data[i].name field. When the tooltip displays this data, the malicious script can run, potentially leading to unauthorized actions such as stealing user information, session hijacking, or defacing the user interface.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, users are recommended to upgrade Apache ECharts to version 6.1.0 or later.

This upgrade fixes the issue related to the Lines series tooltip rendering logic that could lead to cross-site scripting (XSS).


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart