PT-2026-42882 · Apache · Apache Echarts

Lakshmikanthan K · CVE-2026-45249 · Published 2026-05-23 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache ECharts versions prior to 6.1.0

Description A cross-site scripting (XSS) issue exists in the Lines series tooltip rendering logic. When the Lines series and tooltip are used without a user-specified tooltip.formatter, and series.data[i].name is provided, raw HTML strings in series.data[i].name can be rendered through an innerHTML sink into the tooltip content. While tooltips typically allow raw HTML via custom formatters, the built-in formatters usually perform HTML escaping automatically; however, this specific case fails to do so, potentially leading to script execution when tooltips are displayed.

Recommendations Upgrade to version 6.1.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CLEANSTART-2026-KT42152

CVE-2026-45249

GHSA-FGMJ-FM8M-JVVX

Affected Products

Apache Echarts

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45249.json · Exploit
• https://github.com/apache/echarts/pull/21608 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-53655 · Security Note
• https://lists.apache.org/thread/1g6xk7gd9vg1c6zyqqt2lnko10zomc3o · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53550 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44979 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-46625 · Security Note
• https://osv.dev/vulnerability/GHSA-fgmj-fm8m-jvvx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-12143 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45249 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-KT42152 · Vendor Advisory
• https://github.com/apache/echarts · Note
• https://github.com/apache/echarts/commit/1e39b00eedda0e4a0b048e099c0e13ce7149d90f · Note
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KT42152.json · Note