CVE-2026-45249

MediumCVSS 6.1/10Last modified Jul 23, 2026

Description

A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.

This issue affects Apache ECharts: from before 6.1.0.

In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.

Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache ECharts	< 6.1.0

References

https://echarts.apache.org/en/option.html#series-linesProduct
https://echarts.apache.org/handbook/en/best-practices/security/#passing_raw_html_safelyProduct
https://github.com/apache/echarts/pull/21608Issue Tracking, Patch
https://lists.apache.org/thread/1g6xk7gd9vg1c6zyqqt2lnko10zomc3oMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/23/4Mailing List, Third Party Advisory

Timeline

Published: May 25, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-45258.8If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Va CVE-2026-452507.8The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-su CVE-2026-452517.8A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked t CVE-2026-452525.5When a fusefs file system implements extended attributes, the kernel may send a FUSE_LISTXATTR message to the userspace daemon to retrieve t CVE-2026-452538.4ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with CVE-2026-452546.5In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allo CVE-2026-452557.5When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to p CVE-2026-452565.5When used to deliver a signal to a specific thread, thr_kill2(2) called p_cansignal() to determine whether the operation was permitted but d CVE-2026-452577.8The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This CVE-2026-452587.8dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This CVE-2026-452596.5sigqueue(2) was marked as permitted in capability mode with the introduction of Capsicum in 2011, but the implementation of kern_sigqueue di CVE-2026-45266.5In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the