# Upstream issue and advisory assessments

Collected at **2026-10-30T10:51:17Z** for the inherited ApexCharts **4.7.0** baseline. These are assessment records, not a claim that every listed upstream issue affects WestCoast Charts.

## Coverage and limits

The initial collection includes **14 issue candidates** from six keyword searches (security, vulnerability, CVE, XSS, injection and sanitize), and **1 canonical advisory** after deduplication across GitHub Advisory Database and OSV. All six declared searches completed without truncation in this snapshot. The npm Bulk Advisory query covered the inherited 4.7.0 version.

Keyword searches are not a review of every upstream issue, comment or code path. A closed upstream issue is not evidence of a WCC fix. No advisory returned for a package/version query does not prove the absence of vulnerabilities, especially in vendored or forked code. The [coverage record](/audits/upstream-source-coverage.json) lists exact queries, endpoints, pagination and collection errors; the [full assessment ledger](/audits/upstream-risk-ledger.json) retains source metadata and evidence.

## Advisory and released-behavior records

### GHSA-w46j-8hm6-h8mm / CVE-2021-23327

- Status: **under-review**. Human review: **pending**.
- On the exact released WCC 1.1.2 Core UMD (SHA-256 ac1041866883148ad29c527c36271162aece16603b57286fd70c19e4aee1abc0), tested default data-derived legend names rendered as text and custom formatter output with default sanitization retained no event handlers; neither tested default path executed the local marker. Explicit chart.sanitizeHtml=false retained and executed the local onerror marker. This is evidence only for these tested legend paths and artifact; raw HTML opt-out remains unsafe by design. Human review is pending; no universal not-affected conclusion.
- [Original record](https://github.com/advisories/GHSA-w46j-8hm6-h8mm)
- [Exact-release hostile-input browser evidence](/audits/upstream-cve-2021-23327-test-evidence.json)
- No released WCC fix is claimed by this row.
- Next evidence: Human maintainer review of the exact 1.1.2 artifact, browser evidence, and explicit raw-HTML opt-out boundary. Re-probe any later release artifact before claiming equivalence.

### WCC-GAUGE-DOMAIN-UNIT

- Status: **resolved**. Human review: **pending**.
- The 1.1.1 screen-reader overview announced 180% for a custom 0–240 domain while the visible SVG value and data table showed the custom formatted value. Core 1.1.2 now formats the accessibility overview from the same domain-aware gauge value formatter used by the visible label and table. The fix is present in the published 1.1.2 artifact and covered by the gauge unit assertions and browser evidence.
- Fixed in: 1.1.2.


## Upstream candidates awaiting applicability review

These rows are collected leads. Their titles alone do not establish relevance or impact; each requires an affected-version/code-path assessment before it becomes a WCC finding.

| Upstream record | Title | WCC assessment status |
| --- | --- | --- |
| [GH-1029](https://github.com/apexcharts/apexcharts.js/issues/1029) | radar chart negative render stroke and markers error | open / source-screened-candidate |
| [GH-2202](https://github.com/apexcharts/apexcharts.js/issues/2202) | HTML for tooltip is rendering as string | open / source-screened-candidate |
| [GH-2214](https://github.com/apexcharts/apexcharts.js/issues/2214) | HTML no longer parsed in tooltip formatter | open / source-screened-candidate |
| [GH-238](https://github.com/apexcharts/apexcharts.js/issues/238) | ShadowDOM support | open / source-screened-candidate |
| [GH-2412](https://github.com/apexcharts/apexcharts.js/issues/2412) | 🚨 Potential Cross-site Scripting (XSS) - DOM | under-review / assessed-by-agent-awaiting-human-review |
| [GH-2463](https://github.com/apexcharts/apexcharts.js/issues/2463) | v3.27.0 release breaks functionality for returning html from formatters | open / source-screened-candidate |
| [GH-3328](https://github.com/apexcharts/apexcharts.js/issues/3328) | Series labels are vulnerable to XSS attacks  | under-review / assessed-by-agent-awaiting-human-review |
| [GH-3539](https://github.com/apexcharts/apexcharts.js/issues/3539) | Columns - 1st and last columns not showing - 6 series - 5 columns (each with 5 datapoints) + 1 as a line | open / source-screened-candidate |
| [GH-3937](https://github.com/apexcharts/apexcharts.js/issues/3937) | Tooltips evaluate malicious javascript by default | under-review / assessed-by-agent-awaiting-human-review |
| [GH-4502](https://github.com/apexcharts/apexcharts.js/issues/4502) | 安全漏洞：更新内部 svg.js 文件 | under-review / assessed-by-agent-awaiting-human-review |
| [GH-5146](https://github.com/apexcharts/apexcharts.js/issues/5146) | CSP Violation during Export (Strict Policy Incompatibility) | under-review / assessed-by-agent-awaiting-human-review |
| [GH-709](https://github.com/apexcharts/apexcharts.js/issues/709) | x-axis values not rendered properly for real-time chart | open / source-screened-candidate |
| [GH-727](https://github.com/apexcharts/apexcharts.js/issues/727) | Is it possible to disable unsafe inline style in ApexCharts ? | under-review / assessed-by-agent-awaiting-human-review |
| [GH-816](https://github.com/apexcharts/apexcharts.js/issues/816) | xaxis:categories are open to XSS attack. Tooltip does not escape the category but bottom of the graph does it | under-review / assessed-by-agent-awaiting-human-review |

## Collection and release controls

The read-only GitHub Actions collector is installed on the default branch and is scheduled daily at **07:21 UTC**, with manual dispatch also available. It has read-only repository permissions and uploads a proposal artifact; it cannot commit a fix, change this ledger, publish a package, deploy a site or publish an advisory. A human assesses the proposal and records evidence before a status change. Code fixes require the corresponding regression checks and the exact release review described in the [maintenance policy](/maintenance/).

Last successful collection run in the recorded operational snapshot: **2026-10-30T10:42:53Z**, [run 41042720797](https://github.com/Lokumbus/west-coast-charts-core/actions/runs/41042720797), triggered by `workflow\_dispatch`. Snapshot checked at 2026-10-30 12:08:16 UTC. This is the latest success verified by this snapshot; it is not a claim of a newer live run or a successful scheduled run. [Recorded operational evidence](/audits/maintenance-operational-status-2026-10-30.json).

An issue is marked not affected only with supporting code/reproduction evidence. A resolved row names a **released** fixed version; an unreleased candidate is recorded separately. Confirmed security vulnerabilities affecting released WCC packages use a reviewed GitHub Security Advisory with ecosystem/package/version ranges. Platform indexing and notifications remain subject to GitHub/npm behavior.

[Source comparison](/audits/apexcharts-4.7.0-lineage/) · [Security reporting](/SECURITY.md) · [Core SBOM](/downloads/west-coast-charts-1.1.1.core.cdx.json)