Story · 1 source · 1 articlefirst Sep 9, 11:34 UTCupdated Sep 9, 11:34 UTC (7d ago)

Critical zero-click XSS in MapLibre GL JS (CVE-2026-85061) fixed in maplibre-gl 6.4.1

highVulnerabilityimportance 63CVE-2026-85061

What's new: First merged summary for this story (no previous summary existed). The merge consolidated two 2026-09-09 reports that agree on the CVE (CVE-2026-85061), advisory ID (GHSA-jrc7-96c5-q579), affected versions (6.4.0 and earlier), fixed version (6.4.1), CVSS vector, root cause, and remediation. Added from Cyber Security News: the ~2.7 million-user exposure estimate (attributed as an estimate from a…

Merged summary · glm-5.3-flash · rewritten as coverage arrives

MapLibre GL JS versions 6.4.0 and earlier contain a critical zero-click XSS, CVE-2026-85061 (GHSA-jrc7-96c5-q579), caused by DOM.sanitize() mishandling a live NamedNodeMap; the flaw is rated Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) and is fixed…

Both reports describe the same vulnerability: a critical cross-site scripting flaw, CVE-2026-85061 (GHSA-jrc7-96c5-q579), in the DOM.sanitize() function of MapLibre GL JS. Because the sanitizer iterates a live NamedNodeMap while deleting attributes, index shifting causes it to skip attributes adjacent to removed ones; event-handler attributes such as onload and ontoggle survive sanitization and later execute via innerHTML in the attribution control. Exploitation requires no user interaction, privileges, or authentication and is triggered when untrusted attribution strings are rendered, including apps loading third-party map styles or user-supplied attributions. The flaw affects maplibre-gl versions 6.4.0 and earlier and is rated Critical by GitHub with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. Cyber Security News estimates roughly 2.7 million users are exposed and lists potential impacts including session theft, unauthorized actions, phishing redirects, and map content manipulation. The fix in 6.4.1 snapshots attributes using Array.from(elem.attributes) before iterating; organizations should upgrade to 6.4.1 or later and rebuild affected bundles. Interim mitigations include pre-sanitizing attribution inputs, auditing configurations, and enforcing CSP, though the reports characterize upgrading to 6.4.1 as the reliable fix. The two reports are consistent on all technical details, with no discrepancies; GBHackers published first (2026-09-09T11:34:34Z), followed by Cyber Security News (2026-09-09T14:05:10Z).

Vulnerability: CVE-2026-85061 (GitHub advisory GHSA-jrc7-96c5-q579), a zero-click cross-site scripting flaw in MapLibre GL JS's DOM.sanitize().
Affected software: maplibre-gl versions 6.4.0 and earlier; fixed in maplibre-gl 6.4.1.
Severity: rated Critical by GitHub; CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N (network attack vector, no privileges or authentication required, no user interaction required, scope changed, high confidentiality and integrity…
Root cause: DOM.sanitize() iterates a live NamedNodeMap while deleting attributes; index shifting causes the sanitizer to skip attributes adjacent to removed entries.
Exploit path: surviving event-handler attributes (e.g., onload, ontoggle) execute via innerHTML in the attribution control with zero user interaction, triggered by untrusted attribution strings.
Exposure context: affects apps loading third-party map styles or user-supplied attributions; one report (Cyber Security News, 2026-09-09) estimates ~2.7 million users exposed.
Potential impacts (per reports): session theft, unauthorized actions, phishing redirects, and map content manipulation.
Fix: version 6.4.1 snapshots attributes with Array.from(elem.attributes) before iteration; upgrade to 6.4.1 or later and rebuild affected bundles.

VendorsMapLibre

ProductsMapLibre GL JS maplibre-gl

OrganizationsGitHub

Coverage timelineoldest first · each row is one article

Sep 9, 11:34 UTC · 7d ago
GBHackers· 55
Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks
MapLibre GL JS 6.4.1 patches CVE-2026-85061, a critical zero-click XSS in DOM.sanitize() affecting versions 6.4.0 and earlier.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-85061	Sanitization Bypass (DOM XSS) in MapLibre GL JS Attribution Control MapLibre GL JS, an interactive vector tile map library for web browsers distributed via npm, contains a cross-site scripting flaw (CWE-79) in DOM.sanitize() in src/util/dom.ts: the code iterates elem.attributes as a live NamedNodeMap while removeAttributes() deletes entries from that same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, so an event-handler attribute such as onload or ontoggle survives sanitization. The surviving attribute executes when the attribution control inserts the content into the page via innerHTML and the victim renders the affected map content — no interaction beyond viewing the map is required, which is why coverage describes it as a zero-click XSS. Any website or application embedding a vulnerable MapLibre GL JS version and rendering attacker-influenced attributions is affected; successful exploitation gives the attacker arbitrary JavaScript execution in the trusted site's origin, useful for credential/session theft or content manipulation. Exploitation is not yet confirmed: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days, despite the critical CVSS 3.1 score of 10. Do: Upgrade to MapLibre GL JS 6.4.1 or later, which fixes the live NamedNodeMap iteration bug in DOM.sanitize(). In the interim, strip or validate event-handler attributes (e.g., onload, ontoggle) from third-party style attribution strings and user-supplied custom attributions before they reach the map library, and check npm lockfiles for maplibre-gl versions below 6.4.1.	10.0	<1%		MapLibre GL JS (npm: maplibre-gl) all versions prior to 6.4.1 (fixed in 6.4.1)	mass≈2.7M users of MapLibre-embedded sites (per related news coverage of this flaw)	12d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-85061

Sanitization Bypass (DOM XSS) in MapLibre GL JS Attribution Control

MapLibre GL JS, an interactive vector tile map library for web browsers distributed via npm, contains a cross-site scripting flaw (CWE-79) in DOM.sanitize() in src/util/dom.ts: the code iterates elem.attributes as a live NamedNodeMap while removeAttributes() deletes entries from that same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, so an event-handler attribute such as onload or ontoggle survives sanitization. The surviving attribute executes when the attribution control inserts the content into the page via innerHTML and the victim renders the affected map content — no interaction beyond viewing the map is required, which is why coverage describes it as a zero-click XSS. Any website or application embedding a vulnerable MapLibre GL JS version and rendering attacker-influenced attributions is affected; successful exploitation gives the attacker arbitrary JavaScript execution in the trusted site's origin, useful for credential/session theft or content manipulation. Exploitation is not yet confirmed: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days, despite the critical CVSS 3.1 score of 10.

Do: Upgrade to MapLibre GL JS 6.4.1 or later, which fixes the live NamedNodeMap iteration bug in DOM.sanitize(). In the interim, strip or validate event-handler attributes (e.g., onload, ontoggle) from third-party style attribution strings and user-supplied custom attributions before they reach the map library, and check npm lockfiles for maplibre-gl versions below 6.4.1.

10.0

<1%

MapLibre GL JS (npm: maplibre-gl) all versions prior to 6.4.1 (fixed in 6.4.1)

mass≈2.7M users of MapLibre-embedded sites (per related news coverage of this flaw)

12d ago