CVE-2026-85061 with a CVSS score of 10.0, affects applications that render untrusted map styles or custom attributions, allowing attackers to execute zero-click attacks by bypassing the DOM sanitizer function in Live NamedNodeMap Removal Skip via providing an HTML payload containing consecutive dangerous attributes. The sanitizer strips the first attribute while missing the second one, which executes upon insertion into innerHTML without requiring user input. This flaw enables attackers to hijack user sessions or steal sensitive data, posing a significant risk for any platform displaying third-party map data. Specifically, this vulnerability affects library versions prior to 6.4.1, and developers must update their web mapping applications immediately by upgrading to MapLibre GL JS version 6.4.1 or the latest release.
We recommend you to update maplibre-gl to version 6.4.1.[/subscribe_to_unlock_form]
CVE-2026-85061 with a CVSS score of 10.0, affects applications that render untrusted map styles or custom attributions, allowing attackers to execute zero-click attacks by bypassing the DOM sanitizer function in Live NamedNodeMap Removal Skip via providing an HTML payload containing consecutive dangerous attributes. The sanitizer strips the first attribute while missing the second one, which executes upon insertion into innerHTML without requiring user input. This flaw enables attackers to hijack user sessions or steal sensitive data, posing a significant risk for any platform displaying third-party map data. Specifically, this vulnerability affects library versions prior to 6.4.1, and developers must update their web mapping applications immediately by upgrading to MapLibre GL JS version 6.4.1 or the latest release.
We recommend you to update maplibre-gl to version 6.4.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]