Apache ECharts before version 6.1.0 contains a CWE-79 cross-site scripting vulnerability in the Lines series tooltip rendering logic. If both Lines series and tooltip are used without a user-specified tooltip.formatter, and series.data[i].name is set, the raw HTML string in series.data[i].name is inserted via innerHTML into the tooltip content without escaping. This can lead to script execution when tooltips are displayed, violating the expected automatic HTML escaping behavior of built-in tooltip formatters. Upgrading to version 6.1.0 resolves this issue.

This vulnerability allows an attacker to inject and execute arbitrary scripts in the context of the affected web application’s tooltips when using the Lines series without a custom tooltip formatter. This can lead to typical XSS impacts such as session hijacking, content manipulation, or other malicious actions executed in the victim’s browser. No known exploits in the wild have been reported as of the publication date.

Users should upgrade Apache ECharts to version 6.1.0 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgraded, avoid using Lines series tooltips without a custom tooltip.formatter that properly escapes or sanitizes series.data[i].name values.