CVE-2026-85061 Details
Description
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
A cross-site scripting (XSS) vulnerability has been identified in MapLibre GL JS versions through 6.4.0. The issue arises in the DOM.sanitize() function, which processes element attributes as a live NamedNodeMap. While this function removes attributes, the removal shifts the index of subsequent attributes, potentially allowing a dangerous attribute to survive sanitization. This vulnerability can be exploited by injecting consecutive harmful attributes into untrusted third-party style attributions or user-supplied custom attributions. When the sanitized content is rendered, the surviving attribute, such as onload or ontoggle, can execute scripts, leading to XSS. The vulnerability requires no user interaction and can be exploited in applications that use MapLibre GL JS to render maps with such untrusted attribution strings.
Users are advised to upgrade to MapLibre GL JS version 6.4.1 or later, and to sanitize attribute fields before passing them to MapLibre.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27 | [email protected] | Source CodeVendor |
| https://github.com/maplibre/maplibre-gl-js/pull/8189 | [email protected] | Source CodeVendor |
| https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1 | [email protected] | Release NotesVendor |
| https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MapLibre GL JS | <= 6.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |