CVE-2026-85061

Received Received - Intake

DOM-based XSS in MapLibre GL JS Library

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85061

Affected Vendors & Products

Vendor	Product	Version / Range
maplibre	gl_js	to 6.4.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

MapLibre GL JS is a library for creating interactive maps in web browsers. A vulnerability exists in versions before 6.4.1 where DOM sanitization fails to properly remove dangerous attributes like onload or ontoggle. This happens because the sanitization process iterates over a live list of attributes while another function removes them, causing some dangerous attributes to be skipped and remain in the code.

Detection Guidance

This vulnerability is specific to MapLibre GL JS versions before 6.4.1. Check your application's package.json or dependency files for the MapLibre GL JS version. If using npm, run 'npm list maplibre-gl' to verify the installed version. If it is below 6.4.1, the system is vulnerable.

Impact Analysis

If you use a vulnerable version of MapLibre GL JS and render map content controlled by an attacker, they could execute arbitrary JavaScript code in your browser. This could lead to data theft, session hijacking, or other malicious actions while you interact with the map.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive user data. This may violate GDPR's data protection requirements or HIPAA's security rules if personal or health information is compromised due to the exploit.

Mitigation Strategies

Upgrade MapLibre GL JS to version 6.4.1 or later immediately. If upgrading is not possible, review and sanitize all user-supplied or third-party style attribution strings to remove dangerous attributes like onload or ontoggle before rendering. Avoid using innerHTML with untrusted content.

Hi! I’m here to help you understand CVE-2026-85061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70