Apache ECharts contains an XSS flaw in the Lines series tooltip rendering logic. When a Lines series is used together with the tooltip component, and the user does not supply a custom tooltip.formatter, the series data name can be rendered directly into the tooltip content via innerHTML. Because the built‑in tooltip formatters automatically escape HTML, this case negates that safeguard and may allow a malicious script contained in the series data name to execute in the browser when the tooltip is displayed.

The vulnerability affects all releases of Apache ECharts prior to version 6.1.0 that use the Lines series with a tooltip and without a custom formatter. The flaw is triggered only when the series data includes a name field containing a raw HTML string.

The flaw is a classic XSS weakness (CWE‑79) that can cause arbitrary script execution in the client’s browser when the attacker can supply a series data name containing a script. The CVSS score is 6.1 and the EPSS score is < 1%; the vulnerability is not listed in the CISA KEV catalog. The potential impact is that an attacker who can inject content into the data source can run scripts with the privileges of the user viewing the chart.