---
id: CVE-2026-85061
title: MapLibre GL JS is an interactive vector tile map library for web browsers
summary: >-
  MapLibre GL JS is an interactive vector tile map library for web browsers.
  Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as
  a live NamedNodeMap while removeAttributes() removes attributes from the same
  collec…
severity: critical
cvss: 10
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: maplibre-gl
product: maplibre-gl
affected:
  - maplibre-gl <= 6.4.0
patched:
  - maplibre-gl 6.4.1
published: '2026-09-03'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85061'
references:
  - url: >-
      https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27
    label: security-advisories@github.com
  - url: 'https://github.com/maplibre/maplibre-gl-js/pull/8189'
    label: security-advisories@github.com
  - url: 'https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85061'
  - url: 'https://github.com/advisories/GHSA-jrc7-96c5-q579'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00522
epssPercentile: 0.41885
aliases:
  - GHSA-jrc7-96c5-q579
ecosystem: npm
ingestedAt: '2026-09-08T21:11:12.322Z'
---

## Overview

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-85061)

Affected packages:

- `maplibre-gl <= 6.4.0`

Patched in:

- `maplibre-gl 6.4.1`

Source: https://github.com/advisories/GHSA-jrc7-96c5-q579