{"id":"CVE-2026-85061","title":"MapLibre GL JS is an interactive vector tile map library for web browsers","summary":"MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collec…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwe":["CWE-79"],"vendor":"maplibre-gl","product":"maplibre-gl","affected":["maplibre-gl <= 6.4.0"],"patched":["maplibre-gl 6.4.1"],"published":"2026-09-03","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85061","references":[{"url":"https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27","label":"security-advisories@github.com"},{"url":"https://github.com/maplibre/maplibre-gl-js/pull/8189","label":"security-advisories@github.com"},{"url":"https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1","label":"security-advisories@github.com"},{"url":"https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85061"},{"url":"https://github.com/advisories/GHSA-jrc7-96c5-q579"}],"tags":["nvd","ghsa","npm"],"epss":0.00522,"epssPercentile":0.41885,"aliases":["GHSA-jrc7-96c5-q579"],"ecosystem":"npm","ingestedAt":"2026-09-08T21:11:12.322Z","slug":"CVE-2026-85061","body":"## Overview\n\nMapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-85061)\n\nAffected packages:\n\n- `maplibre-gl <= 6.4.0`\n\nPatched in:\n\n- `maplibre-gl 6.4.1`\n\nSource: https://github.com/advisories/GHSA-jrc7-96c5-q579","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}