PT-2026-42882 · Apache · Apache Echarts

Lakshmikanthan K · Published 2026-05-23 · Updated 2026-05-28 · CVE-2026-45249

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache ECharts versions prior to 6.1.0

Description A cross-site scripting (XSS) issue exists in the Lines series tooltip rendering logic. When the Lines series and tooltip are used without a user-specified tooltip.formatter, and series.data[i].name is provided, raw HTML strings in series.data[i].name can be rendered through an innerHTML sink into the tooltip content. While tooltips typically allow raw HTML via custom formatters, the built-in formatters usually perform HTML escaping automatically; however, this specific case fails to do so, potentially leading to script execution when tooltips are displayed.

Recommendations Upgrade to version 6.1.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-45249

Affected Products

Apache Echarts

References · 11

• https://github.com/apache/echarts/pull/21608 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-45249 · Security Note
• https://lists.apache.org/thread/1g6xk7gd9vg1c6zyqqt2lnko10zomc3o · Vendor Advisory
• https://twitter.com/CVEnew/status/2058935278849360226 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2059079319146938582 · Twitter Post
• https://twitter.com/oss_security/status/2058078741520077250 · Twitter Post
• https://t.me/CVEtracker/54838 · Telegram Post
• https://echarts.apache.org/en/option.html#series-lines · Note
• https://echarts.apache.org/handbook/en/best-practices/security/#passing_raw_html_safely · Note
• http://openwall.com/lists/oss-security/2026/05/23/4 · Note
• https://t.me/cveNotify/165007 · Telegram Post