https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:43:30 +0000 https://vulnerability.circl.lu/vuln/cve-2026-45249 <p><strong>Affected:</strong> Apache Software Foundation Apache ECharts</p> <p>A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.</p> <p>This issue affects Apache ECharts: from before 6.1.0.</p> <p>In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.</p> <p>Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache ECharts</p> <p>A cross-site scripting (XSS) vulnerability exists in Apache ECharts in the Lines series tooltip rendering logic.</p> <p>This issue affects Apache ECharts: from before 6.1.0.</p> <p>In versions prior to 6.1.0, if both Lines series and tooltip are used, and no user-specified tooltip.formatter is provided, and series.data[i].name is specified, raw HTML string series.data[i].name can be rendered through innerHTML sink into tooltip content. Although tooltip is allowed to accept user-provided raw HTML via a custom tooltip.formatter, the built-in tooltip formatters conventionally perform HTML escaping automatically. This case breaks that convention and may unexpectedly lead to script execution when tooltips are displayed.</p> <p>Users are recommended to upgrade to version 6.1.0 if using the Lines series in this way, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-45249