Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

MapLibre GL JS may run malicious code via crafted attribution

CVE-2026-85061 · published today
Summary

The interactive map library MapLibre GL JS (versions before 6.4.1) can fail to remove dangerous HTML attributes when processing custom attribution text. An attacker who supplies specially crafted attribution strings could inject code that runs when a user views the map. Update the library to version 6.4.1 or later to stop this from happening.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
maplibre maplibre-gl-js < 6.4.1
Original advisory text
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes()...
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
References
Severity
10.0 Critical
CVSS 3.1: 10.0 (MITRE)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Sep 2026
Updated3 Sep 2026
First seen3 Sep 2026
Sources
CVE-2026-85061 · NVD
CVE-2026-85061 · MITRE
Monitor software like this
Free during beta