CVE-2026-85061

CRITICAL 10.0

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

CVSS Score

10.0

EPSS Score

0.0%

EPSS Percentile

0th

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.

CWE	CWE-79
Vendor	maplibre
Product	maplibre-gl-js
Published	Sep 3, 2026

Stay Ahead of the Next One

Get instant alerts for maplibre maplibre-gl-js

Be the first to know when new critical vulnerabilities affecting maplibre maplibre-gl-js are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

maplibre / maplibre-gl-js

< 6.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579 github.com: https://github.com/maplibre/maplibre-gl-js/pull/8189 github.com: https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27 github.com: https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1