A high-severity cross-site scripting (XSS) vulnerability has been disclosed in MapLibre GL JS, exposing about 2.7 million users to zero-click attacks. Tracked under CVE-2026-85061 (GitHub Advisory GHSA-jrc7-96c5-q579), the issue affects versions 6.4.0 and earlier of the open-source mapping library. The dangerous behavior stems from its DOM.sanitize() function, designed to strip unsafe HTML attributes before integrating content into web pages, but deeply flawed in how it handles attribute removal.
Vulnerability Mechanics
Researchers identified that when sanitizing element attributes, the code iterates through a NamedNodeMap collection while simultaneously removing dangerous attributes via elem.removeAttribute(). Doing so shifts the index positions of remaining attributes, which leads to skipping checks for any malicious attribute that immediately follows a removed one. Attackers can exploit this by supplying HTML with two unsafe attributes in a row—one might be stripped, but the next could survive.
The issue becomes particularly dangerous because the surviving attribute can execute automatically. When MapLibre later injects content (such as attribution strings or map styles) into the DOM—via innerHTML in the attribution control—the remaining event handler may trigger without user interaction. No authentication or special user action is needed, which categorizes this as a zero-click exploit.
Risk and Resolution
The potential damage is broad. Attackers could run script in the victim’s browser context, leading to session hijacking, unauthorized actions, access to sensitive data, phishing redirection, or even manipulation of map displays. Services that fetch map styles, third-party attribution text, or allow user-submitted attribution are especially vulnerable.
This vulnerability is rated critical under CVSS v3.1: it’s exploitable over a network (AV:N), with low complexity (AC:L), no required privileges (PR:N), zero user interaction (UI:N), and severe impact to confidentiality and integrity. Affected input falls under CWE-79 (Improper Neutralization of Input). The flaw has been fixed in MapLibre GL JS version 6.4.1, which updates the sanitization logic to first copy attributes into a static array before iterating, avoiding the index shift problem.
What Developers Should Do
Organizations using MapLibre GL JS are strongly urged to upgrade to version 6.4.1 or later. Before that upgrade, additional layers of input validation are critical—particularly for map styles or attributive data coming from external or user sources. Sanitizing attribution inputs independently of MapLibre’s built-in sanitization is a stopgap, though not a full substitute.
It’s essential to review any part of your stack that passes untrusted data into mapping components—especially custom attribution content. Even systems not directly exposing user input can be at risk if they display third-party style metadata or load map content from remote sources without a safety check.
This vulnerability highlights the risks lurking in open-source libraries handling dynamic content and HTML sanitization. MapLibre GL JS is widely used in web applications to render interactive maps, and the zero-click nature of this XSS flaw means malicious code can activate without any user trigger. What to watch: whether similar sanitization routines in other mapping or visualization libraries suffer from equivalent logic flaws, and how fast maintainers and downstream users deploy fixes. Developers should treat version 6.4.1 as mandatory, audit any exposed input paths, and monitor for near-identical issues in comparable libraries moving forward.
