apache/echarts

form-data 2.3.3

2 advisories. Fixed in 2.5.4.

How it can be abusedAn attacker could try to predict or manipulate the random boundary string that separates parts of an HTTP file upload, or inject extra upload fields through crafted names. In this project form-data is only a development tooling dependency used by build scripts, not code shipped to users of the charting library, so real-world exposure is limited to developers running those scripts.

• criticalGHSA-fjxv-7rqg-78g4form-data uses unsafe random function in form-data for choosing boundary
• highGHSA-hmw2-7cc7-3qxxform-data: CRLF injection in form-data via unescaped multipart field names and filenames

tar 6.2.1

9 advisories. Fixed in 7.5.19.

How it can be abusedAn attacker could craft a malicious archive that, when unpacked on a developer's machine during install or release steps, writes files outside the intended folder or hangs the process. Only contributors and CI systems building this browser charting library are exposed; end users loading charts in a browser are never affected because the tar code never ships to them.

• criticalGHSA-23hp-3jrh-7fpwnode-tar: Decompression/parse DoS via unlimited input
• highGHSA-34x7-hfp2-rc4vnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
• highGHSA-83g3-92jg-28cxArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
• highGHSA-8qq5-rm4j-mr97node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
• highGHSA-8x88-c5mf-7j5wnode-tar: Negative tar entry size causes infinite loop in archive replace
• highGHSA-9ppj-qmqm-q256node-tar Symlink Path Traversal via Drive-Relative Linkpath
• highGHSA-qffp-2rhf-9h96tar has Hardlink Path Traversal via Drive-Relative Linkpath
• highGHSA-r292-9mhp-454mnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
• highGHSA-r6q2-hw4h-h46wRace Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

brace-expansion 2.0.2

3 advisories. Fixed in 5.0.7.

How it can be abusedThis package expands file patterns like {} lists and is only used by developer tools during builds and linting, not by the charting library in the browser. An attacker who could get a crafted pattern into a contributor's or CI build setup could hang or crash that process with huge memory use, but end users of the published library are not affected.

• highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
• highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
• highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

braces 2.3.2

1 advisory. Fixed in 3.0.3.

How it can be abusedThis bug only matters if untrusted text reaches the braces pattern expander at runtime, causing it to freeze or exhaust memory. In ECharts it exists only in developer build tools and never ships to browsers, so website visitors are not exposed; only a developer feeding attacker-controlled filenames into their own build could be slowed down.

• highGHSA-grv7-fg5c-xmjgUncontrolled resource consumption in braces

js-yaml 3.14.2

2 advisories. Fixed in 3.15.0.

How it can be abusedAn attacker who can feed a crafted YAML file to code using js-yaml could make parsing take huge amounts of CPU, slowing or freezing the process. In ECharts, js-yaml is only used by build and development tools, not shipped to users, so real-world impact is limited to developers processing untrusted YAML files during builds or tests.

• highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
• highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

lodash 4.17.23

1 advisory. Fixed in 4.18.0.

How it can be abusedThe flaw lives in lodash's template function, which can run arbitrary JavaScript if an attacker gets to control the text fed into a template. ECharts only uses lodash as a helper during its own build and internal tooling, not on data from website visitors, so an attacker would have no way to reach this code; users of charts built with the library are not affected.

• highGHSA-r5fr-rjxr-66jclodash vulnerable to Code Injection via `_.template` imports key names

minimatch 9.0.5

3 advisories. Fixed in 10.2.3.

How it can be abusedThis package matches file names against patterns and can freeze when given a maliciously crafted pattern. In ECharts it is only used at build time on the developer's own machine to pick files during bundling, so an attacker would have to trick a maintainer into running the build with hostile patterns, and end users of the charting library are never exposed.

• highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
• highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

rollup 2.34.2

2 advisories. Fixed in 3.29.5.

How it can be abusedAn attacker could abuse this if a website loads an ECharts bundle built with this rollup version onto a page where the attacker can also add hidden HTML elements with special names, tricking the script into running their code and affecting that site's visitors. However, this library is built once and published, so the risk falls on sites embedding the bundle in attackable pages, not on developers building it.

• highGHSA-gcx4-mw62-g8wmDOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
• highGHSA-mw96-cpmx-2vgcRollup 4 has Arbitrary File Write via Path Traversal

semver 7.3.8

1 advisory. Fixed in 7.5.2.

How it can be abusedThe flaw lets a maliciously crafted version string make the semver library freeze while matching text, which could hang whatever process feeds it versions. In this charting library semver is not used to process user-supplied input in the browser, so an attacker has no realistic way to reach the vulnerable code.

• highGHSA-c2qf-rxjj-qqgwsemver vulnerable to Regular Expression Denial of Service

serialize-javascript 6.0.2

1 advisory. Fixed in 7.0.3.

How it can be abusedThis package is only used in the build scripts that bundle ECharts, and the flaw lets code run on your machine if it serializes attacker-controlled data like dates or regexes. Since builds process only trusted local source files, an attacker would need to already control your build environment, so library users are not affected.

• highGHSA-5c6j-r48x-rmvqSerialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()