Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks
MapLibre GL JS 6.4.1 patches CVE-2026-85061, a critical zero-click XSS in DOM.sanitize() affecting versions 6.4.0 and earlier.
A critical cross-site scripting vulnerability, CVE-2026-85061 (GHSA-jrc7-96c5-q579), affects maplibre-gl versions 6.4.0 and earlier and is fixed in 6.4.1. The flaw stems from DOM.sanitize() iterating a live NamedNodeMap while deleting attributes, causing the sanitizer to skip adjacent dangerous event-handler attributes that later execute via innerHTML. GitHub rates the issue Critical with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, exploitable without user interaction when untrusted attribution strings are rendered. Organizations should upgrade to 6.4.1 or later, rebuild affected bundles, and sanitize attribution fields as an interim measure.
- Sanitizer skips adjacent attributes when removing entries from a live NamedNodeMap
- Zero-click XSS triggered through malicious attribution strings inserted via innerHTML
- Fix snapshots attributes using Array.from(elem.attributes) before iteration
- Interim mitigations: pre-sanitize attribution data, audit configs, enforce CSP
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-85061 | Sanitization Bypass (DOM XSS) in MapLibre GL JS Attribution Control MapLibre GL JS, an interactive vector tile map library for web browsers distributed via npm, contains a cross-site scripting flaw (CWE-79) in DOM.sanitize() in src/util/dom.ts: the code iterates elem.attributes as a live NamedNodeMap while removeAttributes() deletes entries from that same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, so an event-handler attribute such as onload or ontoggle survives sanitization. The surviving attribute executes when the attribution control inserts the content into the page via innerHTML and the victim renders the affected map content — no interaction beyond viewing the map is required, which is why coverage describes it as a zero-click XSS. Any website or application embedding a vulnerable MapLibre GL JS version and rendering attacker-influenced attributions is affected; successful exploitation gives the attacker arbitrary JavaScript execution in the trusted site's origin, useful for credential/session theft or content manipulation. Exploitation is not yet confirmed: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days, despite the critical CVSS 3.1 score of 10. Do: Upgrade to MapLibre GL JS 6.4.1 or later, which fixes the live NamedNodeMap iteration bug in DOM.sanitize(). In the interim, strip or validate event-handler attributes (e.g., onload, ontoggle) from third-party style attribution strings and user-supplied custom attributions before they reach the map library, and check npm lockfiles for maplibre-gl versions below 6.4.1. | 10.0 | <1% |
| mass≈2.7M users of MapLibre-embedded sites (per related news coverage of this flaw) |
Full article483 words · extracted from gbhackers.com · click to collapse
MapLibre GL JS users are advised to upgrade their software following the disclosure of an XSS vulnerability, identified as CVE-2026-85061 and documented in GitHub advisory GHSA-jrc7-96c5-q579.
This vulnerability affects maplibre-gl versions 6.4.0 and earlier and is resolved in version 6.4.1.
Critical MapLibre GL JS Flaw
The issue lies in the DOM.sanitize() function in src/util/dom.ts, which removes unsafe attributes from HTML content before it reaches the browser’s DOM.
The problem occurs because the vulnerable code iteratively processes elem.attributes, a live NamedNodeMap, while removing attributes from that collection. As a result, deleting one attribute shifts subsequent attributes, potentially causing the loop to skip adjacent attributes.
An attacker can exploit this behavior by supplying HTML that includes consecutive dangerous attributes. For example, an attacker might use open, onload, and ontoggle attributes on a details element.
Although the sanitizer may remove the first unsafe attribute, it might leave the next executable event-handler attribute intact. When MapLibre then inserts the remaining HTML through innerHTML in its attribution control, this can allow browser-side JavaScript to execute.
This vulnerability is particularly concerning because it requires no user interaction to exploit. Applications that render untrusted or third-party styled attribution strings, or accept user-controlled custom attribution content, could expose visitors to zero-click XSS attacks.
A malicious payload from a source that the application considers trusted could run in the context of the vulnerable site, facilitating data theft, interface manipulation, or actions executed as the victim, subject to the browser’s controls and the application’s design.
GitHub rates this flaw as Critical and assigns it a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. This score indicates that the vulnerability can be exploited over the network with low complexity, without requiring any privileges or action from the victim.
The changed scope and significant confidentiality and integrity impacts demonstrate that an injected script could affect assets beyond the vulnerable MapLibre component, while availability impact is rated as none.
The fix modifies the sanitizer to create a static snapshot of attributes using Array.from(elem.attributes) before iterating, preventing any mutations to the collection that could alter the traversal and ensuring that each captured attribute is evaluated.
Organizations are encouraged to update maplibre-gl to version 6.4.1 or later, rebuild any affected web applications, and confirm that their bundles do not retain the vulnerable dependency.
For teams unable to apply the patch immediately, sanitize the source’s attribution field before passing it to MapLibre. Additionally, they should audit map configurations, third-party style providers, and user-input paths for attribution values.
Since XSS defenses are layered, implementers should not consider the workaround as a substitute for upgrading and should maintain contextual output encoding and Content Security Policy protections.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/critical-maplibre-gl-js-vulnerability/