CVE-2026-76154 in OSS
Summary
by MITRE • 09/18/2026
A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The identified security flaw resides within the Geomap panel of the application, specifically affecting the integration and rendering logic for MapLibre base layers. This vulnerability is classified as a stored cross-site scripting (XSS) issue, which distinguishes it from reflected XSS by persisting the malicious payload on the server side rather than transmitting it solely through HTTP requests. The root cause lies in the insufficient sanitization of user-supplied data when processing style configurations for map visualizations. An attacker with Editor privileges can craft a specific JSON-based style configuration that includes executable JavaScript code within properties intended for styling or labeling purposes. When this malicious configuration is saved, it becomes part of the application's persistent state, effectively storing the exploit vector on the server infrastructure rather than in transient request parameters.
The operational impact of this vulnerability is severe due to its ability to facilitate privilege escalation from a standard Editor role to an Organization Administrator level. Because the payload is stored, any user with sufficient permissions to view or interact with the compromised Geomap panel will inadvertently trigger the execution of the malicious JavaScript within their browser session context. This allows the attacker to hijack active sessions, steal sensitive authentication tokens such as JSON Web Tokens (JWT) or session cookies, and perform actions on behalf of other users without detection. The ability to escalate privileges means that an attacker can manipulate administrative settings, access restricted data repositories, modify system configurations, and potentially install further persistent backdoors within the application environment, thereby compromising the integrity and confidentiality of the entire organizational unit managed by the platform.
From a technical classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the injection of executable scripts into web pages viewed by other users through stored data inputs. Furthermore, in terms of tactical mapping according to the MITRE ATT&CK framework for enterprise security, this exploit corresponds to T1059 Command and Control Execution via JavaScript, allowing remote code execution within the client environment. It also relates to T1078 Valid Accounts, as it leverages legitimate user credentials to gain unauthorized access, and potentially T1249 Reliance on Remote Service for Data Exfiltration if the script sends stolen data to an external command-and-control server controlled by the attacker.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Immediately, developers should implement strict input validation and output encoding specifically tailored for JSON structures used in MapLibre style definitions. All user-supplied strings within these configurations must be sanitized against a whitelist of allowed characters and functions, ensuring that no executable code can be embedded within property values. Additionally, implementing Content Security Policy (CSP) headers with restrictive script-src directives can significantly reduce the impact by preventing unauthorized scripts from executing even if they are injected into the DOM. Long-term solutions should involve adopting secure coding practices such as using templating engines that automatically escape output and conducting regular third-party security audits focused on rich internet application components like mapping libraries to identify similar injection points in other data visualization modules.