ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

maplibre-gl

1 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks

Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.

A flaw in MapLibre GL JS's DOM.sanitize() iterates a live NamedNodeMap while removing attributes, skipping malicious attributes placed adjacent to removed ones, letting event handlers like onload and ontoggle survive and execute via innerHTML in the attribution control. Tracked as CVE-2026-85061 and GHSA-jrc7-96c5-q579, the flaw affects maplibre-gl versions 6.4.0 and earlier, is rated critical under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and requires no user interaction, privileges, or authentication. Exploitation could enable session theft, unauthorized actions, phishing redirects, or map content manipulation; the patch in 6.4.1 snapshots attributes with Array.from before iterating.

Cyber Security News · 6d agoVulnerability 2 sourcesCVE-2026-85061

Related CVEs

  • CVE-2026-8506110.0<1%
    Sanitization Bypass (DOM XSS) in MapLibre GL JS Attribution Control
    MapLibre GL JS, an interactive vector tile map library for web browsers distributed via npm, contains a cross-site scripting flaw (CWE-79) in DOM.sanitize() in src/util/dom.ts: the code iterates elem.attributes as a live NamedNodeMap while removeAttributes() deletes entries from that same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, so an event-handler attribute such as onload or ontoggle survives sanitization. The surviving attribute executes when the attribution control inserts the content into the page via innerHTML and the victim renders the affected map content — no interaction beyond viewing the map is required, which is why coverage describes it as a zero-click XSS. Any website or application embedding a vulnerable MapLibre GL JS version and rendering attacker-influenced attributions is affected; successful exploitation gives the attacker arbitrary JavaScript execution in the trusted site's origin, useful for credential/session theft or content manipulation. Exploitation is not yet confirmed: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days, despite the critical CVSS 3.1 score of 10.
    · MapLibre GL JS (npm: maplibre-gl) all versions prior to 6.4.1 (fixed in 6.4.1)mass

Appears with

organization GitHub 1product MapLibre GL JS 1vendor MapLibre 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.