Junglewise Threat Intelligence

CVE-2026-85061: MapLibre GL JS XSS sanitizer bypass in DOM.sanitize()

CVE-2026-85061 · Severity: critical · CVSS 10 · Published 2026-09-08

Executive brief

MapLibre GL JS is a web mapping library that renders interactive maps in browsers. The library's DOM sanitization function contains a flaw that allows attackers to bypass input filtering and inject malicious JavaScript code that executes without user interaction. This zero-click XSS attack can occur when an application renders untrusted attribution strings or user-supplied custom map attributions, potentially allowing attackers to steal data, hijack sessions, or perform actions on behalf of users viewing affected maps.

Technical details

The vulnerability exists in the DOM.sanitize() function in src/util/dom.ts, which iterates over elem.attributes (a live NamedNodeMap) while simultaneously removing dangerous attributes via elem.removeAttribute(). Because NamedNodeMap is live, removing an attribute shifts all subsequent attributes down by one index, causing the loop iterator to skip the next attribute in the sequence. An attacker can craft an HTML payload with multiple consecutive dangerous attributes (e.g., <details open onload="1" ontoggle="alert(1)">) where the sanitizer removes the first attribute but skips the second, allowing the second dangerous attribute to survive. This occurs in the attribution control, where untrusted style-supplied attribution strings are passed through DOM.sanitize before being assigned to innerHTML. The resulting code executes immediately upon DOM insertion without requiring user interaction. The fix involves creating a static snapshot of the attributes array using Array.from(elem.attributes) before iteration, preventing the skip behavior. MapLibre GL JS versions <= 6.4.0 are vulnerable; version 6.4.1 and later include the fix.

Affected products

  • MapLibre GL JS <= 6.4.0

Timeline

  • 2026-08-19: disclosed: GHSA advisory published
  • 2026-08-18: patched: Fix merged in PR #8189 (commit 1da69f3)
  • 2026-09-03: other: NVD published CVE-2026-85061

References