Executive brief
Apache ECharts is a popular data visualization library used to create interactive charts on websites. A security flaw in the 'Lines' chart type allows malicious code to be executed in a user's browser if the chart displays specially crafted data. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Apache ECharts versions prior to 6.1.0. The vulnerability is located in the 'Lines' series tooltip rendering logic. When a 'Lines' series is used without a custom 'tooltip.formatter', the library fails to properly escape the 'series.data[i].name' property, passing it directly into an innerHTML sink. An attacker who can control the data name (e.g., via user-supplied data rendered in a chart) can inject malicious HTML/JavaScript. While ECharts generally expects developers to sanitize data for custom formatters, the built-in formatters are expected to handle escaping automatically; this specific component failed to follow that convention. The issue is fixed in version 6.1.0 by ensuring line item names are processed through the tooltip markup builder.
Affected products
- Apache ECharts < 6.1.0
Timeline
- 2026-05-08: patched: Pull request merged to fix the vulnerability
- 2026-05-25: advisory: NVD published date
- 2026-05-26: disclosed: GitHub Advisory published