MapLibre: Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks

Critical XSS Vulnerability in MapLibre GL JS Patched in Version 6.4.1

A critical cross-site scripting (XSS) vulnerability, tracked as CVE-2026-85061 (GitHub advisory GHSA-jrc7-96c5-q579), has been disclosed in MapLibre GL JS, affecting versions 6.4.0 and earlier. The flaw, rated Critical with a CVSS v3.1 score of 9.6, allows attackers to execute arbitrary JavaScript in a victim’s browser without user interaction.

The vulnerability stems from a flaw in the DOM.sanitize() function in src/util/dom.ts, which is designed to strip unsafe HTML attributes before rendering. Due to an issue in how the function iterates over a live NamedNodeMap of attributes, removing one attribute shifts the remaining ones, potentially causing the sanitizer to skip adjacent malicious attributes. Attackers could exploit this by crafting HTML with consecutive dangerous attributes (e.g., open, onload, ontoggle), allowing one to bypass sanitization and execute when inserted via innerHTML.

Exploitation requires no privileges or user interaction, making it a zero-click XSS risk for applications that render untrusted or third-party attribution strings. Successful attacks could lead to data theft, UI manipulation, or actions performed on behalf of the victim, with impacts extending beyond the vulnerable component due to the flaw’s changed scope (S:C).

The issue has been patched in MapLibre GL JS version 6.4.1, which modifies the sanitizer to use a static snapshot of attributes (Array.from(elem.attributes)) to prevent mutation during iteration. Organizations are advised to upgrade immediately, rebuild affected applications, and verify dependency chains. Temporary mitigations include pre-sanitizing attribution inputs and auditing configurations, though these should not replace patching. Additional defenses, such as Content Security Policy (CSP), remain recommended.

Source: https://gbhackers.com/critical-maplibre-gl-js-vulnerability/

MapLibre TPRM report: https://www.rankiteo.com/company/maplibre

"id": "map1788956845",
"linkid": "maplibre",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Geospatial/Mapping',
                        'name': 'MapLibre GL JS',
                        'type': 'Software Library'}],
 'attack_vector': 'Remote',
 'data_breach': {'data_exfiltration': 'Potential data theft'},
 'description': 'A critical cross-site scripting (XSS) vulnerability, tracked '
                'as CVE-2026-85061 (GitHub advisory GHSA-jrc7-96c5-q579), has '
                'been disclosed in MapLibre GL JS, affecting versions 6.4.0 '
                'and earlier. The flaw allows attackers to execute arbitrary '
                'JavaScript in a victim’s browser without user interaction due '
                'to a sanitization bypass in the `DOM.sanitize()` function.',
 'impact': {'data_compromised': 'Potential data theft',
            'operational_impact': 'UI manipulation, actions performed on '
                                  'behalf of the victim',
            'systems_affected': 'Applications using MapLibre GL JS versions '
                                '6.4.0 and earlier'},
 'post_incident_analysis': {'corrective_actions': 'Modified sanitizer to use a '
                                                  'static snapshot of '
                                                  'attributes '
                                                  '(`Array.from(elem.attributes)`) '
                                                  'to prevent mutation during '
                                                  'iteration',
                            'root_causes': 'Flaw in `DOM.sanitize()` function '
                                           'in `src/util/dom.ts` causing '
                                           'sanitization bypass due to live '
                                           '`NamedNodeMap` mutation during '
                                           'iteration'},
 'recommendations': 'Upgrade to MapLibre GL JS version 6.4.1 immediately. '
                    'Apply temporary mitigations such as pre-sanitizing '
                    'attribution inputs and auditing configurations. Implement '
                    'Content Security Policy (CSP) as an additional defense.',
 'references': [{'source': 'GitHub Advisory', 'url': 'GHSA-jrc7-96c5-q579'}],
 'response': {'containment_measures': 'Upgrade to MapLibre GL JS version 6.4.1',
              'recovery_measures': 'Rebuild affected applications, verify '
                                   'dependency chains',
              'remediation_measures': 'Patch applied to modify '
                                      '`DOM.sanitize()` function to use a '
                                      'static snapshot of attributes'},
 'title': 'Critical XSS Vulnerability in MapLibre GL JS Patched in Version '
          '6.4.1',
 'type': 'Cross-Site Scripting (XSS)',
 'vulnerability_exploited': 'CVE-2026-85061 (GHSA-jrc7-96c5-q579)'}