Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-85061— MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

Quick assessment

Affected
maplibre maplibre-gl-js
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MapLibre GL JS 是一个用于 Web 浏览器的交互式矢量瓦片地图库。在 6.4.1 版本之前， 中的 函数在遍历 （一个活的 NamedNodeMap）的同时， 会从同一集合中移除属性，导致索引发生偏移，从而跳过相邻的危险属性。能够控制不受信任的第三方样式署名字符串或用户提供的自定义署名的攻击者，可以提供连续的危险属性，使得如 或 等属性在净化过程中幸存，并在署名控件将内容插入 时执行。受害者必须渲染受影响的地图内容才能触发脚本执行。该问题已在 6.4.1 版本中修复。

CVSS 10.0 · Critical

Possible ATT&CK Techniques 1 AI

T1218 · System Binary Proxy Execution
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85061

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
Source: CVE Program / CVE List V5
Vulnerability Description
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
maplibre maplibre-gl-js < 6.4.1 -

II. Public POCs for CVE-2026-85061

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85061

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-85061 (2)

Vendor Advisories for CVE-2026-85061 (1)

Vendor Pages for CVE-2026-85061 (1)

IV. Related Vulnerabilities

Same weakness: CWE-79

V. Comments for CVE-2026-85061

No comments yet

Leave a comment