MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks
Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.
A flaw in MapLibre GL JS's DOM.sanitize() iterates a live NamedNodeMap while removing attributes, skipping malicious attributes placed adjacent to removed ones, letting event handlers like onload and ontoggle survive and execute via innerHTML in the attribution control. Tracked as CVE-2026-85061 and GHSA-jrc7-96c5-q579, the flaw affects maplibre-gl versions 6.4.0 and earlier, is rated critical under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and requires no user interaction, privileges, or authentication. Exploitation could enable session theft, unauthorized actions, phishing redirects, or map content manipulation; the patch in 6.4.1 snapshots attributes with Array.from before iterating.
- Sanitizer skips attributes due to index shifting while mutating a live NamedNodeMap
- Payload executes via attribution control innerHTML with zero user interaction
- Affects apps loading third-party map styles or user-supplied attributions
- Fixed in 6.4.1 by copying attributes with Array.from before iteration
- Mitigation: sanitize attribution inputs, but upgrading to 6.4.1 is the reliable fix
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-85061 | Sanitization Bypass (DOM XSS) in MapLibre GL JS Attribution Control MapLibre GL JS, an interactive vector tile map library for web browsers distributed via npm, contains a cross-site scripting flaw (CWE-79) in DOM.sanitize() in src/util/dom.ts: the code iterates elem.attributes as a live NamedNodeMap while removeAttributes() deletes entries from that same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, so an event-handler attribute such as onload or ontoggle survives sanitization. The surviving attribute executes when the attribution control inserts the content into the page via innerHTML and the victim renders the affected map content — no interaction beyond viewing the map is required, which is why coverage describes it as a zero-click XSS. Any website or application embedding a vulnerable MapLibre GL JS version and rendering attacker-influenced attributions is affected; successful exploitation gives the attacker arbitrary JavaScript execution in the trusted site's origin, useful for credential/session theft or content manipulation. Exploitation is not yet confirmed: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days, despite the critical CVSS 3.1 score of 10. Do: Upgrade to MapLibre GL JS 6.4.1 or later, which fixes the live NamedNodeMap iteration bug in DOM.sanitize(). In the interim, strip or validate event-handler attributes (e.g., onload, ontoggle) from third-party style attribution strings and user-supplied custom attributions before they reach the map library, and check npm lockfiles for maplibre-gl versions below 6.4.1. | 10.0 | <1% |
| mass≈2.7M users of MapLibre-embedded sites (per related news coverage of this flaw) |
Full article520 words · extracted from cybersecuritynews.com · click to collapse
A critical cross-site scripting vulnerability in the widely used MapLibre GL JS library could expose applications and an estimated 2.7 million users to zero-click attacks.
The flaw, tracked as CVE-2026-85061 and GitHub Security Advisory GHSA-jrc7-96c5-q579, affects maplibre-gl versions 6.4.0 and earlier.
MapLibre GL JS is an open-source JavaScript mapping library used by websites and web applications to render interactive maps. The vulnerability exists in the library’s DOM.sanitize() function, which is intended to remove unsafe HTML attributes before inserting content into a page.
Researchers found that the sanitizer processed an element’s attributes through a live browser NamedNodeMap object. While the function iterated through the attributes, it also removed dangerous ones using elem.removeAttribute().
MapLibre Zero-Click Vulnerability
This created an index-shifting condition: once an attribute was removed, the next attribute moved into its position, but the loop advanced to the following index. As a result, the sanitizer could skip a malicious attribute placed directly after another unsafe attribute.
An attacker could exploit the issue by supplying HTML containing consecutive dangerous attributes. GitHub’s advisory provided an example involving a details element with attributes such as open, onload, and ontoggle.
The sanitizer may remove one malicious attribute but fail to inspect or remove the adjacent event handler. When MapLibre later inserts the surviving payload into innerHTML through its attribution control, the event handler can execute automatically.
The attack requires no user interaction, authentication, or special privileges. This makes it particularly serious for services that load map styles, attribution text, or other mapping data from third-party sources.
Applications that let users provide custom attributions may also be vulnerable if they pass those values to MapLibre without independent validation and sanitization.
Successful exploitation could allow attackers to execute JavaScript in the security context of a victim’s browser. Depending on the affected application, this could enable account-session theft, unauthorized actions, sensitive-data access, redirection to phishing pages, or manipulation of visible map content.
The issue received a critical severity rating under CVSS v3.1. Its vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, reflecting network-based exploitation, low complexity, no required privileges, and zero user interaction.
The advisory classifies the weakness as CWE-79, improper neutralization of input during web page generation, commonly known as cross-site scripting.
MapLibre maintainers fixed the flaw in maplibre-gl version 6.4.1. The patch changes the sanitizer’s behavior by first creating a static copy of element attributes with Array. from (elem. attributes). from(elem.attributes). The code can then safely inspect and remove attributes without changing the collection it’s currently iterating.
Organizations using MapLibre GL JS should immediately upgrade to version 6.4.1 or the latest available release. Security teams should also identify applications that process untrusted map style metadata, third-party attribution strings, or user-controlled custom attribution fields.
As a temporary mitigation, developers should sanitize attribution-related input before supplying it to MapLibre. However, upgrading remains the most reliable remediation because the vulnerable logic is part of the library’s internal DOM sanitization process.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/maplibre-zero-click-vulnerability/