CVE-2026-45249

A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic. This issue affects Apache ECharts: from before 6.1.0. In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed. Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.

• CWE-79

• https://echarts.apache.org/en/option.html#series-linesProduct
• https://echarts.apache.org/handbook/en/best-practices/security/#passing_raw_html_safelyProduct
• https://github.com/apache/echarts/pull/21608Issue Tracking, Patch
• https://lists.apache.org/thread/1g6xk7gd9vg1c6zyqqt2lnko10zomc3oMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/05/23/4Mailing List, Third Party Advisory

Published

May 25, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45243Summarize prior to 0.15.1 contains a missing authorization v…6.1
• CVE-2026-45244Summarize prior to 0.15.1 contains a missing authorization v…5.4
• CVE-2026-45245Summarize prior to 0.15.1 contains a vulnerability in the ho…7.4
• CVE-2026-45246Summarize prior to 0.15.1 contains an insecure file permissi…6.8
• CVE-2026-45247Mirasvit Full Page Cache Warmer for Magento 2 before version…9.8
• CVE-2026-45248Hedera Guardian through 3.5.1 contains an authentication byp…6.9
• CVE-2026-4525If a Vault auth mount is configured to pass through the "Aut…8.8
• CVE-2026-45250The setcred(2) system call is only available to privileged u…7.8
• CVE-2026-45251A file descriptor can be closed while a thread is blocked in…7.8
• CVE-2026-45252When a fusefs file system implements extended attributes, th…5.5
• CVE-2026-45253ptrace(PT_SC_REMOTE) failed to properly validate parameters …8.4
• CVE-2026-45254In the case of the cap_net service, when a key present in th…6.5