{"action":"Upgrade echarts to 6.1.0 or later.","affected":[{"fixed":"6.1.0","introduced":"0"}],"component":"echarts","cve_ids":["CVE-2026-45249"],"ecosystem":"npm","epss":0.00749,"exploited":false,"fixed_versions":["6.1.0"],"ghsa_id":"GHSA-fgmj-fm8m-jvvx","id":"tcs_01M5KFNG35QS2Q0ZTE64F1B74K","modified_at":"2026-09-10T03:50:46.703392703Z","published_at":"2026-05-26T13:30:40Z","references":["https://osv.dev/vulnerability/GHSA-fgmj-fm8m-jvvx","https://nvd.nist.gov/vuln/detail/CVE-2026-45249","https://github.com/apache/echarts/pull/21608","https://github.com/apache/echarts/commit/1e39b00eedda0e4a0b048e099c0e13ce7149d90f","https://echarts.apache.org/en/option.html#series-lines","https://echarts.apache.org/handbook/en/best-practices/security/#passing_raw_html_safely","https://github.com/apache/echarts","https://lists.apache.org/thread/1g6xk7gd9vg1c6zyqqt2lnko10zomc3o","http://www.openwall.com/lists/oss-security/2026/05/23/4"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-fgmj-fm8m-jvvx","url":"https://osv.dev/vulnerability/GHSA-fgmj-fm8m-jvvx"}],"summary":"Apache ECharts has a cross-site scripting (XSS) vulnerability"}