2.7M Users Exposed to CVE-2026-85061: Critical 10.0 CVSS MapLibre Flaw

MapLibre GL JS handles nearly 2.7 million weekly downloads for web mapping applications. Specifically, a critical MapLibre XSS vulnerability allows attackers to execute zero-click attacks. This severe flaw affects applications that render untrusted map styles or custom attributions.

Why This Threat Matters

MapLibre GL JS serves as an open-source library for publishing interactive maps on websites. Furthermore, developers rely heavily on this tool for fast, GPU-accelerated vector tile rendering. The MapLibre XSS vulnerability allows malicious code execution without any user interaction. Therefore, attackers can easily hijack user sessions or steal sensitive data. A zero-click flaw greatly increases the risk for any platform displaying third-party map data.

How the Attack Works

First, the issue originates directly within the DOM sanitizer function. The library code iterates through a live list of node attributes while simultaneously removing them. Consequently, removing an attribute shifts the remaining items down by one index. Next, the iterator skips the adjacent attribute entirely. Attackers exploit this by providing an HTML payload containing consecutive dangerous attributes. The sanitizer strips the first attribute but misses the second one. The security advisory explains, “The first attribute is stripped while the second survives and executes upon insertion into innerHTML.” This execution occurs via the attribution control without requiring user input.

Affected Versions

This MapLibre GL JS flaw affects library versions prior to 6.4.1. Currently, security researchers have not confirmed any active exploitation in the wild. Additionally, public proof-of-concept exploits do not currently exist.

Patch and Mitigation Steps

Developers must update their web mapping applications immediately. The software maintainers resolved the issue by creating a static snapshot of attributes before the iteration process begins. Users should upgrade to MapLibre GL JS version 6.4.1 or the latest release. Finally, if immediate patching remains impossible, administrators should manually sanitize the attribute field of a source before passing it down to MapLibre.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.