Critical MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks

Key Takeaways

• A critical cross-site scripting (XSS) vulnerability, CVE-2026-85061, has been discovered in MapLibre GL JS.
• The flaw impacts versions 6.4.0 and earlier of the widely used JavaScript mapping library, potentially affecting 2.7 million users.
• Exploitation requires no user interaction, making it a zero-click attack vector with a CVSS v3.1 score reflecting critical severity.
• A patch is available in MapLibre GL JS version 6.4.1, and immediate upgrades are strongly recommended.

Critical Zero-Click Vulnerability Found in MapLibre GL JS

A severe cross-site scripting (XSS) vulnerability within the MapLibre GL JS library could expose web applications and an estimated 2.7 million users to zero-click attacks. Identified as CVE-2026-85061 and detailed in GitHub Security Advisory GHSA-jrc7-96c5-q579, the flaw impacts all versions of maplibre-gl up to and including 6.4.0.

Understanding the Vulnerability in MapLibre GL JS

MapLibre GL JS is a popular open-source JavaScript library utilized by websites and web applications for rendering interactive maps. The core of the vulnerability resides within the library’s DOM.sanitize() function. This function is designed to strip potentially malicious HTML attributes before content is embedded into a webpage, acting as a crucial security measure.

Researchers discovered that the sanitizer processed an element’s attributes directly from a live browser NamedNodeMap object. While iterating through these attributes to identify and remove dangerous ones using elem.removeAttribute(), an issue arose. The removal of an attribute caused subsequent attributes to shift their indices within the live collection. However, the loop’s iterator advanced to the next fixed index, effectively skipping the inspection of the attribute that had moved into the previously checked position.

Exploitation Mechanism

This index-shifting behavior allowed an attacker to bypass the sanitization process by crafting HTML that contained consecutive dangerous attributes. As GitHub’s advisory provided, an example involves a details element with attributes like open, onload, and ontoggle. The sanitizer might successfully remove one malicious attribute, but then fail to inspect or remove an adjacent, equally dangerous event handler due to the skipped index.

When MapLibre subsequently injects the unsanitized payload into innerHTML via its attribution control, the surviving event handler can execute automatically. The severity of this vulnerability is heightened by its zero-click nature; no user interaction, authentication, or elevated privileges are required for exploitation. This poses a significant risk for services that ingest map styles, attribution text, or other mapping data from untrusted third-party sources. Applications that permit users to submit custom attribution fields without robust, independent validation are also susceptible if these values are passed directly to MapLibre.

Successful exploitation could enable attackers to execute arbitrary JavaScript code within the victim’s browser context. The potential consequences vary depending on the target application but could include session hijacking, unauthorized actions, access to sensitive data, redirection to phishing sites, or manipulation of map content visible to users.

Severity and Remediation

The vulnerability has been assigned a critical severity rating under CVSS v3.1, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. This score reflects its network-based exploitability, low attack complexity, lack of required privileges, and zero user interaction. The weakness is categorized as CWE-79, or improper neutralization of input during web page generation, commonly known as Cross-Site Scripting.

MapLibre maintainers have addressed the flaw in maplibre-gl version 6.4.1. The patch modifies the sanitizer’s approach by first creating a static copy of an element’s attributes using Array.from(elem.attributes). This ensures that the code can safely inspect and remove attributes without altering the collection it is currently iterating over, thereby preventing the index-shifting issue.

What You Should Do

• Upgrade Immediately: Organizations utilizing MapLibre GL JS should prioritize upgrading to version 6.4.1 or the latest available release without delay.
• Identify Vulnerable Applications: Security teams should conduct an audit to identify applications that process untrusted map style metadata, third-party attribution strings, or user-controlled custom attribution fields.
• Implement Temporary Sanitization: As an interim measure, developers should implement robust, independent sanitization of all attribution-related input before supplying it to MapLibre. However, this should not replace the official library upgrade.
• Review Input Handling: Always follow best practices for handling user-supplied content and external data, ensuring all input is validated and sanitized at the server-side and client-side where appropriate.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.