A significant security flaw in the popular MapLibre GL JS library has surfaced, potentially exposing applications and approximately 2.7 million users to zero-click attacks. This vulnerability, identified as CVE-2026-85061 and noted in GitHub Security Advisory GHSA-jrc7-96c5-q579, impacts maplibre-gl versions 6.4.0 and earlier.
Understanding the MapLibre Vulnerability
MapLibre GL JS, an open-source JavaScript library, is widely used for rendering interactive maps on websites and web applications. The vulnerability is located in the library’s DOM.sanitize() function, a mechanism designed to eliminate unsafe HTML attributes before incorporating content into a web page. Researchers identified that this sanitizer processed an element’s attributes via a live browser NamedNodeMap object. During attribute iteration, it removed potentially harmful ones using elem.removeAttribute().
How the Exploit Works
This removal process creates an index-shifting issue: once an attribute is discarded, the subsequent attribute occupies its place, while the loop progresses to the next index. Consequently, the sanitizer might overlook a malicious attribute positioned directly after another harmful attribute. Attackers could exploit this by providing HTML with sequential dangerous attributes. GitHub’s advisory included an example using a details element with attributes like open, onload, and ontoggle.
The sanitizer might remove one malicious attribute but miss inspecting or eliminating the adjacent event handler. When MapLibre later inserts the remaining payload into innerHTML through its attribution control, the event handler could execute without user intervention. This attack doesn’t require user interaction, authentication, or special privileges, posing a severe threat to services loading map styles or data from third-party sources.
Impact and Mitigation Strategies
Applications allowing users to input custom attributions may be vulnerable if these values are passed to MapLibre without independent validation and sanitization. Successful exploitation enables attackers to execute JavaScript within the security context of a victim’s browser, potentially leading to account-session theft, unauthorized actions, sensitive-data access, phishing page redirects, or map content manipulation.
The vulnerability has been rated critical under CVSS v3.1, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating network-based exploitation, low complexity, no required privileges, and zero user interaction. The weakness falls under CWE-79, improper neutralization of input during web page generation, commonly known as cross-site scripting.
MapLibre maintainers have addressed the flaw in maplibre-gl version 6.4.1, modifying the sanitizer’s operation by initially creating a static copy of element attributes. This approach allows safe inspection and removal of attributes without altering the collection currently being processed. Organizations using MapLibre GL JS should promptly upgrade to version 6.4.1 or the latest release. Security teams should also identify applications processing untrusted map style metadata or user-controlled custom attribution fields.
As a temporary measure, developers should sanitize attribution-related inputs before supplying them to MapLibre. Nevertheless, upgrading is the most dependable solution due to the vulnerability residing in the library’s internal DOM sanitization process.
