4.6.0

Last update: 03/06/2026

echarts

Apache ECharts is a powerful, interactive charting and data visualization library for browser

Version: 4.6.0

Safety score

Check your open source dependency risks. Get immediate insight about security, stability and licensing risks.

De-risk your app now

Security Risks of Known Vulnerabilities

CVE-2026-45249
CWE-79
Threat level: MEDIUM | CVSS score: 6.1

A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.

This issue affects Apache ECharts: from before 6.1.0.

In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.

Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.

Please note that this component is affected by other vulnerabilities
Critical | High | Medium | Low | Suggest

Latest safe major: 6.1.0 Scan your application codebase with Meterian to see all known vulnerabilities in your open source software dependencies.

Stability

Stay updated with the latest patches and releases. Plan your sofware desisgn. Avoid common known vulnerabilities fixed by the open source community

Latest patch release: --

Latest minor release: 4.9.0

Latest major release: 6.1.0

Licensing

Maintain your licence declarations and avoid unwanted licences to protect your IP the way you intended.

Apache-2.0 - Apache License 2.0

Not a wildcard

Not proprietary

OSI Compliant