Threats affecting pkg:npm/echarts

Apache ECharts versions prior to 6.1.0 contain a cross-site scripting (XSS) vulnerability in the Lines series tooltip rendering logic. When using Lines series with tooltips and no custom tooltip.formatter, raw HTML content in series.data[i].name can be rendered without proper escaping, potentially allowing script execution. This vulnerability breaks the usual automatic HTML escaping convention in built-in tooltip formatters. The issue is fixed in version 6.1.0.