CVE-2026-85061 in GL JS
Summary
by MITRE • 09/04/2026
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/04/2026
MapLibre GL JS serves as a foundational interactive vector tile mapping library designed for web browsers, enabling developers to create dynamic and responsive geographic visualizations. The security vulnerability identified within versions prior to 6.4.1 resides specifically in the DOM sanitization logic located in the src/util/dom.ts module. This component is responsible for cleaning user-supplied or third-party content before it is rendered into the browser's Document Object Model, a critical step in preventing Cross-Site Scripting attacks. The core technical flaw stems from an improper interaction between iteration and mutation of live DOM collections. Specifically, the sanitize function iterates over elem.attributes, which returns a NamedNodeMap that reflects changes to the document tree in real time. Concurrently, the removeAttributes method modifies this same collection by deleting specific attributes deemed unsafe.
The operational consequence of this architectural oversight is a classic index-shifting vulnerability inherent to live collections. When an attribute is removed from a live NamedNodeMap during iteration, all subsequent elements shift their indices down by one position. However, standard iterative loops typically advance the index counter sequentially without accounting for these shifts. As a result, the element that was originally at the next index moves into the current slot but is subsequently skipped because the loop increments to the following index. This logic error allows an attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions to bypass sanitization filters by supplying consecutive dangerous attributes. For instance, if two malicious attributes are placed adjacent to each other in the input string, one may be removed while the next is skipped entirely due to the index shift.
This flaw enables a stored Cross-Site Scripting scenario where potentially harmful event handlers such as onload or ontoggle survive the sanitization process intact. When the attribution control subsequently inserts this sanitized content into an element using innerHTML, the browser interprets and executes these embedded scripts immediately upon rendering. The attack requires that a victim user renders the affected map content within their session for the script to execute successfully against them. This highlights the critical importance of input validation in components that handle dynamic HTML insertion, particularly when those inputs originate from external or untrusted sources like third-party style providers.
From an industry standards perspective, this vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it relates to CWE-836 where the use of a live collection leads to unexpected behavior during modification operations. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers as part of client-side code injection attacks. The attack vector is classified under Input Validation failures where the system fails to properly sanitize dynamic content before rendering it in a context that allows script interpretation.
Mitigation strategies for this vulnerability involve upgrading MapLibre GL JS to version 6.4.1 or later, which corrects the iteration logic by either iterating over a static copy of the attributes list rather than the live collection or adjusting index management during removal operations. For organizations unable to upgrade immediately, defensive coding practices should be implemented within custom integrations that utilize this library. Developers must ensure that any HTML content derived from untrusted sources is processed through robust sanitization libraries that do not rely on mutating live DOM collections during iteration. Additionally, implementing Content Security Policy headers can help mitigate the impact of such vulnerabilities by restricting the execution of inline scripts and limiting the domains from which resources can be loaded, thereby reducing the attack surface even if a bypass occurs.