CVE-2026-85061 with a CVSS score of 10.0 is a critical severity vulnerability in MapLibre GL JS that allows for zero-click cross-site scripting (XSS) via the DOM.sanitize function, specifically due to live NamedNodeMap removal skip. An attacker can provide an HTML payload with consecutive dangerous attributes, causing the first attribute to be stripped while the second survives and executes upon insertion into innerHTML without requiring user interaction. The vulnerability affects applications rendering untrusted/third-party style attribution strings or user-supplied custom attributions, and has been resolved by creating a static snapshot of attributes using Array.from(elem.attributes) before iteration. The affected version range is <= 6.4.0, and the fixed version is 6.4.1.
We recommend you to update maplibre-gl to version 6.4.1 or 6.4.1.[/subscribe_to_unlock_form]
CVE-2026-85061 with a CVSS score of 10.0 is a critical severity vulnerability in MapLibre GL JS that allows for zero-click cross-site scripting (XSS) via the DOM.sanitize function, specifically due to live NamedNodeMap removal skip. An attacker can provide an HTML payload with consecutive dangerous attributes, causing the first attribute to be stripped while the second survives and executes upon insertion into innerHTML without requiring user interaction. The vulnerability affects applications rendering untrusted/third-party style attribution strings or user-supplied custom attributions, and has been resolved by creating a static snapshot of attributes using Array.from(elem.attributes) before iteration. The affected version range is <= 6.4.0, and the fixed version is 6.4.1.
We recommend you to update maplibre-gl to version 6.4.1 or 6.4.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]