CVE-2026-45249: Apache ECharts XSS Vulnerability

CVE-2026-45249 Overview

CVE-2026-45249 is a cross-site scripting (XSS) vulnerability in Apache ECharts affecting versions prior to 6.1.0. The flaw exists in the Lines series tooltip rendering logic. When a chart uses the Lines series with the default tooltip and no custom tooltip.formatter, the built-in formatter writes series.data[i].name directly into tooltip content through an innerHTML sink without HTML escaping. Attackers who control the name field can inject arbitrary HTML and JavaScript that executes in the victim's browser context when the tooltip is displayed. This breaks the convention that built-in ECharts tooltip formatters perform automatic HTML escaping.

Critical Impact
Attacker-controlled chart data can execute arbitrary JavaScript in a user's browser session when a Lines series tooltip renders, enabling session theft, defacement, and downstream client-side attacks.

Affected Products

Apache ECharts versions prior to 6.1.0
Web applications embedding Apache ECharts Lines series with default tooltip configuration
Dashboards rendering untrusted or user-supplied data in series.data[i].name

Discovery Timeline

2026-05-25 - CVE-2026-45249 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-45249

Vulnerability Analysis

The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Apache ECharts is a widely deployed JavaScript visualization library used in dashboards, business intelligence tools, and analytics platforms. The Lines series renders line segments between coordinate pairs and supports per-segment metadata, including a name property surfaced through tooltips on hover.

The Lines series tooltip path passes the name value into the DOM through innerHTML rather than textContent. Other built-in ECharts formatters escape HTML by convention, so application developers reasonably assume that data flowing into tooltips is sanitized. The Lines series path violated that assumption, producing a sink-controlled stored XSS condition whenever the chart consumes untrusted data.

Root Cause

The root cause is missing output encoding in the built-in Lines series tooltip formatter. The renderer concatenates series.data[i].name into an HTML string and assigns it to an innerHTML property of the tooltip element. Because the value is treated as markup rather than text, any embedded <script>, <img onerror=...>, or event-handler payload is parsed and executed by the browser.

Attack Vector

Exploitation requires an attacker to influence the name field of a Lines series data point and have a victim interact with the chart so the tooltip renders. User interaction is required, which aligns with the User Interaction Required component of the CVSS vector. Typical scenarios include multi-tenant dashboards that visualize user-submitted records, applications that ingest names from external APIs, and any workflow where chart data crosses a trust boundary without sanitization. The scope change reflects that script execution occurs in the embedding application's origin, granting access to cookies, session storage, and authenticated API endpoints.

The vulnerability is described in prose because no verified proof-of-concept code is published. See the Apache ECharts GitHub Pull Request #21608 for the upstream fix and the Apache Mailing List Discussion for additional context.

Detection Methods for CVE-2026-45249

Indicators of Compromise

HTML or JavaScript markup characters such as <script, onerror=, or javascript: stored in fields that map to ECharts series.data[i].name.
Unexpected outbound requests from browser sessions to attacker-controlled domains shortly after users view chart-rendering pages.
Client-side errors or content-security-policy violations originating from pages that embed Apache ECharts.

Detection Strategies

Inventory applications using Apache ECharts and identify versions below 6.1.0 through software composition analysis of package.json, package-lock.json, and bundled JavaScript.
Scan persisted data stores for HTML or script payloads in fields used as chart labels or series names.
Audit front-end code for usage of the Lines series without a custom tooltip.formatter that performs explicit escaping.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting endpoints to capture inline script violations triggered by injected tooltip payloads.
Monitor web application firewall (WAF) and application logs for HTML-encoded angle brackets or event handler attributes submitted to APIs that feed chart data.
Alert on anomalous DOM mutations or script execution patterns in browser telemetry from monitored endpoints.

How to Mitigate CVE-2026-45249

Immediate Actions Required

Upgrade Apache ECharts to version 6.1.0 or later across all front-end builds and CDN-hosted copies.
Sanitize or HTML-escape any user-controlled value assigned to series.data[i].name before passing it to ECharts.
Provide an explicit tooltip.formatter that uses textContent semantics or a vetted escaping helper when rendering Lines series data.

Patch Information

Apache fixed the issue in ECharts 6.1.0 by ensuring the built-in Lines series tooltip formatter performs HTML escaping consistent with other built-in formatters. Review the Apache ECharts Pull Request #21608 for implementation details and the Apache Mailing List Discussion for the upstream announcement. Additional vendor guidance is available in the Apache ECharts Security Best Practices.

Workarounds

Define a custom tooltip.formatter that escapes HTML before returning the tooltip string, neutralizing the unsafe innerHTML path.
Strip or encode HTML metacharacters from name values at ingestion time using a trusted sanitization library.
Enforce a strict Content Security Policy that disallows inline scripts and untrusted event handlers to limit exploitation impact.

bash

# Configuration example: upgrade Apache ECharts to the patched release
npm install echarts@^6.1.0

# Verify the installed version
npm ls echarts