CVE-2026-45249: Apache ECharts: XSS in Lines series tooltip rendering
A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.
This issue affects Apache ECharts: from before 6.1.0.
In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.
Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache EChartsto a version that resolves this vulnerability.Fixed in 6.1.0Patch CVE-2026-45249
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45249?
CVE-2026-45249 has a risk score of 28, indicating it presents a significant security concern.
How do I fix CVE-2026-45249?
To fix CVE-2026-45249, upgrade Apache ECharts to version 6.1.0 or later, which addresses the XSS vulnerability.
What is the impact of CVE-2026-45249?
CVE-2026-45249 allows for potential cross-site scripting (XSS), enabling attackers to inject malicious scripts through the Lines series tooltip.
Which versions of Apache ECharts are affected by CVE-2026-45249?
CVE-2026-45249 affects all versions of Apache ECharts prior to 6.1.0.
What conditions must be met for CVE-2026-45249 to be exploited?
CVE-2026-45249 can be exploited if both Lines series and tooltips are used without a user-specified tooltip.formatter.