CVE-2026-45249

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45249
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45249.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45249
Aliases
Downstream
Related
Published
2026-05-25T07:38:07.398Z
Modified
2026-07-15T01:48:50.059266661Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Apache ECharts: XSS in Lines series tooltip rendering
Details

A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.

This issue affects Apache ECharts: from before 6.1.0.

In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.

Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45249.json",
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/echarts

Affected ranges

Type
GIT
Repo
https://github.com/apache/echarts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c5a48f5f97d23e5379720870b8444cd05b50ffb4
Database specific 
{
    "cpe": "cpe:2.3:a:apache:echarts:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

1.*
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.3.0
1.3.5
1.3.6
1.3.7
1.3.8
1.4.0
1.4.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.10
2.1.9
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.1.1
3.1.10
3.1.2
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.2.3
3.3.0
3.3.2
3.4.0
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.6.2
3.7.1
3.7.2
3.8.0
3.8.2
3.8.3
3.8.4
3.8.5
4.*
4.0.0
4.0.3
4.1.0
4.1.0-rc.0
4.1.0.rc0
4.2.0-rc.1
4.2.0-rc.2
4.2.1
4.2.1-rc.2
4.2.1-rc.3
4.2.1-rc1
4.3.0
4.3.0-rc.1
4.3.0-rc.2
4.4.0
4.4.0-rc.1
4.5.0
4.5.0-rc.1
4.5.0-rc.2
4.6.0
4.6.0-rc.1
4.7.0
4.7.0-rc.1
4.8.0
4.8.0-rc.1
4.9.0
4.9.0-rc.1
5.*
5.0.0
5.0.0-rc.3
5.0.1
5.0.1-rc.1
5.0.2
5.0.2-rc.1
5.1.0
5.1.0-rc.1
5.1.1
5.1.1-rc.1
5.1.2
5.1.2-rc.1
5.2.0
5.2.0-rc.1
5.2.1
5.2.1-rc.1
5.2.2
5.2.2-rc.1
5.3.0
5.3.0-rc.1
5.3.1
5.3.1-rc.1
5.3.2
5.3.2-rc.1
5.3.3
5.3.3-rc.1
5.4.0
5.4.0-rc.1
5.4.1
5.4.1-rc.1
5.4.2
5.4.2-rc.1
5.4.2-rc1
5.4.3
5.4.3-rc.1
5.5.0
5.5.0-rc.1
5.5.0-rc.2
5.5.1
5.5.1-rc.1
5.6.0
5.6.0-rc.1
6.*
6.0.0
6.0.0-beta.1
6.0.0-rc.1
6.0.0-rc.2
6.1.0-rc.1
v4.*
v4.2.1-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45249.json"