fix: the echarts library processes user-controlled t... in...

[orbisai0security]

Summary

Fix critical severity security issue in dist/echarts.common.js.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	dist/echarts.common.js:18808

Description: The ECharts library processes user-controlled text content for labels, tooltips, and axis text. When tooltip renderMode is set to 'html' (default in browser environments), user-provided content may be rendered without proper HTML entity encoding. The normalizeSetOptionInput function processes options but does not sanitize text content that will be rendered in HTML contexts.

Changes

• dist/echarts.common.js

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[echarts-bot]

Thanks for your contribution!
The community will review it ASAP. In the meanwhile, please checkout the coding standard and Wiki about How to make a pull request.

Please DO NOT commit the files in dist, i18n, and ssr/client/dist folders in a non-release pull request. These folders are for release use only.

To reviewers: If this PR is going to be described in the changelog in the future release, please make sure this PR has one of the following labels: PR: doc ready, PR: awaiting doc, PR: doc unchanged

This message is shown because the PR description doesn't contain the document related template.