MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks
Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.
A flaw in MapLibre GL JS's DOM.sanitize() iterates a live NamedNodeMap while removing attributes, skipping malicious attributes placed adjacent to removed ones, letting event handlers like onload and ontoggle survive and execute via innerHTML in the attribution control. Tracked as CVE-2026-85061 and GHSA-jrc7-96c5-q579, the flaw affects maplibre-gl versions 6.4.0 and earlier, is rated critical under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and requires no user interaction, privileges, or authentication. Exploitation could enable session theft, unauthorized actions, phishing redirects, or map content manipulation; the patch in 6.4.1 snapshots attributes with Array.from before iterating.
- Sanitizer skips attributes due to index shifting while mutating a live NamedNodeMap
- Payload executes via attribution control innerHTML with zero user interaction
- Affects apps loading third-party map styles or user-supplied attributions
- Fixed in 6.4.1 by copying attributes with Array.from before iteration
- Mitigation: sanitize attribution inputs, but upgrading to 6.4.1 is the reliable fix
- CVEs
- CVE-2026-85061
- Vendors
- MapLibre
- Products
- MapLibre GL JSmaplibre-gl
- Organizations
- GitHub
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85061 | Sanitization Bypass (DOM XSS) in MapLibre GL JS Attribution Control | 10.0 | <1% |
From the original article
2 min read at cybersecuritynews.com
A critical cross-site scripting vulnerability in the widely used MapLibre GL JS library could expose applications and an estimated 2. 7 million users to zero-click attacks. The flaw, tracked as CVE-2026-85061 and GitHub Security Advisory GHSA-jrc7-96c5-q579, affects maplibre-gl versions 6.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.