Read the docs
TI-2026-58438 Aliases CVE-2026-85061GHSA-jrc7-96c5-q579

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

Priority MEDIUM 49CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Fix Fixed maplibre-gl-js (maplibre): 6.4.1maplibre-gl (npm): 6.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
maplibremaplibre-gl-jsbefore 6.4.16.4.1Patch availableCNA
—maplibre-gl (npm)before 6.4.16.4.1Patch availableGHSA-jrc7-96c5-q579
  • maplibre-gl-js Vendormaplibre Affected before 6.4.1 Fixed in 6.4.1 Patch available CNA
  • maplibre-gl (npm) Vendor— Affected before 6.4.1 Fixed in 6.4.1 Patch available GHSA-jrc7-96c5-q579

Remediation

  • Fix · CNA maplibre-gl-js (maplibre) Fixed in 6.4.1
  • Fix · GHSA-jrc7-96c5-q579 maplibre-gl (npm) Fixed in 6.4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85061
  2. 2026-10-03 Alias added: GHSA-jrc7-96c5-q579

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences