MapLibre GL JS DOM.sanitize() XSS Sanitizer Bypass (CVE-2026-85061)

// Detect XSS payloads delivered via MapLibre popup/GeoJSON content and CSP violations referencing maplibre bundles
let suspiciousAttrs = dynamic(["onload=", "onerror=", "onmouseover=", "onfocus=", "onclick=", "javascript:", "<img", "<svg", "formaction="]);
union
(
    CommonSecurityLog
    | where DeviceVendor has "CEF" or RequestURL has "maplibre"
    | extend Payload = tostring(RequestContext)
    | where Payload has_any (suspiciousAttrs)
    | project TimeGenerated, SourceIP, DestinationIP, RequestURL, Payload, Signal="waf-xss-maplibre"
),
(
    // CSP violation reports (ingested as custom log) naming maplibre-gl bundles
    CSPViolation_CL
    | where blocked_uri_s has_any ("onload", "javascript", "inline") or source_file_s has "maplibre"
    | project TimeGenerated, SourceIP=client_ip_s, DestinationIP="", RequestURL=document_uri_s, Payload=blocked_uri_s, Signal="csp-violation-maplibre"
)
| order by TimeGenerated desc

(index=web OR index=proxy sourcetype IN ("waf:log","suricata:http","nginx:plus:kv")) (uri_path="*maplibre*" OR user_agent="*") (form_data="*onerror=*" OR form_data="*onload=*" OR form_data="*javascript:*" OR uri_query="*<svg*" OR uri_query="*<img*" OR http_content="*formaction=*")
| eval payload=coalesce(form_data,uri_query,http_content)
| rex field=payload "(?<xss_vector>on\w+\s*=|javascript:|<svg|<img|formaction=)"
| stats count values(xss_vector) as vectors values(uri_path) as paths by src_ip, dest_ip
| where count > 0
| sort - count

any where (network.protocol == "http" or event.category == "web") and
  (
    stringContains(url.query, "onerror=") or
    stringContains(url.query, "onload=") or
    stringContains(http.request.body.content, "javascript:") or
    stringContains(http.request.body.content, "<svg onload") or
    stringContains(http.request.body.content, "formaction=")
  ) and
  stringContains(url.path, "maplibre")

SELECT sourceip, destinationip, "URL" AS url, "Payload" AS payload, QIDNAME(qid) AS event_name
FROM events
WHERE ("URL" ILIKE '%maplibre%' OR "Payload" ILIKE '%maplibre-gl%')
  AND (
    "Payload" IMATCHES '.*on(error|load|mouseover|click)\s*=.*'
    OR "Payload" ILIKE '%javascript:%'
    OR "Payload" ILIKE '%<svg%onload%'
    OR "Payload" ILIKE '%formaction=%'
  )
  AND devicetype IN (SELECT id FROM sensordevicetype WHERE devicetypename ILIKE '%web%' OR devicetypename ILIKE '%proxy%')
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=web/* OR _sourceCategory=proxy/*
| where (%"url" matches "*maplibre*" or %"referrer" matches "*maplibre*")
| where (%"request_body" matches /on(error|load|mouseover|click)\s*=/ or %"request_body" matches "*javascript:*" or %"url" matches "*<svg*" or %"request_body" matches "*formaction=*")
| parse regex field=request_body "(?<xss_vector>on\w+\s*=|javascript:|<svg|formaction=)" nodrop
| count by src_ip, dest_ip, xss_vector
| sort by _count

rule maplibre_xss_sanitizer_bypass_cve_2026_85061 {
  meta:
    author = "argus"
    description = "MapLibre GL JS DOM.sanitize() XSS bypass exploitation (CVE-2026-85061)"
    severity = "CRITICAL"
    cve = "CVE-2026-85061"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.parsed_user_agent.raw, `.*`) or
      $e.target.url = /maplibre/ nocase
    )
    (
      $e.network.http.parsed_user_agent.raw = /placeholder/ or
      re.regex($e.target.url, `(?i)(on(error|load|mouseover|click)\s*=|javascript:|<svg|formaction=)`) or
      re.regex($e.network.http.response.request_body, `(?i)(on(error|load)\s*=|javascript:|<svg onload)`)
    )
  condition:
    $e
}

#event_simpleName=/HttpRequest|DnsRequest/ OR #repo="web"
| (HttpUrl=/maplibre/i OR RequestUrl=/maplibre/i)
| (RequestBody=/(?i)on(error|load|mouseover|click)\s*=/ OR RequestBody=/(?i)javascript:/ OR HttpUrl=/(?i)<svg|formaction=/)
| groupBy([aid, RemoteAddressIP4], function=([count(as=hits), collect([HttpUrl, RequestBody])]))
| sort(hits, order=desc)