CVE-2026-45249

A cross-site scripting (XSS) vulnerability exists in Apache ECharts prior to version 6.1.0 . When using a Lines series and a tooltip without a user-specified tooltip.formatter, the series.data[i].name property can be rendered through an innerHTML sink into the tooltip content. This bypasses the s...