MapLibre GL JS Patches Zero-Click XSS Sanitizer Bypass in DOM.sanitize() (CVE-2026-85061)

What happened

MapLibre disclosed a security advisory (GHSA-jrc7-96c5-q579, CVE-2026-85061) affecting maplibre-gl, a widely used open-source JavaScript map rendering library. According to the advisory, the DOM.sanitize() function in src/util/dom.ts iterated over elem.attributes — a live NamedNodeMap — while calling elem.removeAttribute() inside that same loop. Because removing an attribute shifts the remaining attributes down by one index, the iterator skips whichever attribute lands next in the list.

The advisory states this can be exploited with an HTML payload containing consecutive dangerous attributes, such as <details open>. The first attribute gets stripped by the sanitizer, but the second survives and executes when inserted into innerHTML via the attribution control — with no user interaction required. The advisory carries a CVSS score of 10.0 and is listed as having a public proof-of-concept.

Why it matters for defenders

Any application that renders untrusted or third-party style attribution strings, or accepts user-supplied custom attributions, through maplibre-gl is impacted. Since the payload executes on render with no click or interaction needed, this is a zero-click XSS in the context of the vulnerable page — meaning an attacker-controlled attribution string alone is enough to run arbitrary script in a victim's browser session. Given how common map attribution text is (often sourced from third-party tile/style providers or user-editable map configs), the attack surface may be broader than developers assume.

What defenders should watch for or do now

• Upgrade maplibre-gl to version 6.4.1 or later, where the fix snapshots attributes via Array.from(elem.attributes) before iterating and removing.
• Inventory web applications and internal tools that embed maplibre-gl maps, especially any that accept custom or third-party attribution/style strings.
• Until patched, treat the workaround in the advisory as a stopgap: sanitize the attribution field of any source before passing it to maplibre, rather than relying on the library's internal sanitizer.
• From a hunting perspective, review browser-side error/CSP violation logs and any web application firewall or RUM (real user monitoring) telemetry for attribution strings containing HTML event-handler attributes (e.g. onload, ontoggle) or nested <details>-style payloads.
• Audit any pipeline that generates map styles or attribution text from user input or third-party feeds for injection points.

Developing intel

This item was published today and reflects the vendor's own advisory; details may be refined as the community and vendor publish further analysis. For the authoritative writeup and patch details, see the original GHSA advisory.