Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks
MapLibre GL JS 6.4.1 patches CVE-2026-85061, a critical zero-click XSS in DOM.sanitize() affecting versions 6.4.0 and earlier.
A critical cross-site scripting vulnerability, CVE-2026-85061 (GHSA-jrc7-96c5-q579), affects maplibre-gl versions 6.4.0 and earlier and is fixed in 6.4.1. The flaw stems from DOM.sanitize() iterating a live NamedNodeMap while deleting attributes, causing the sanitizer to skip adjacent dangerous event-handler attributes that later execute via innerHTML. GitHub rates the issue Critical with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, exploitable without user interaction when untrusted attribution strings are rendered. Organizations should upgrade to 6.4.1 or later, rebuild affected bundles, and sanitize attribution fields as an interim measure.
- Sanitizer skips adjacent attributes when removing entries from a live NamedNodeMap
- Zero-click XSS triggered through malicious attribution strings inserted via innerHTML
- Fix snapshots attributes using Array.from(elem.attributes) before iteration
- Interim mitigations: pre-sanitize attribution data, audit configs, enforce CSP
- CVEs
- CVE-2026-85061
- Vendors
- MapLibre
- Products
- MapLibre GL JS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85061 | Sanitization Bypass (DOM XSS) in MapLibre GL JS Attribution Control | 10.0 | <1% |
From the original article
2 min read at gbhackers.com
MapLibre GL JS users are advised to upgrade their software following the disclosure of an XSS vulnerability, identified as CVE-2026-85061 and documented in GitHub advisory GHSA-jrc7-96c5-q579. This vulnerability affects maplibre-gl versions 6. 4.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.