{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/maplibre/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:maplibre:maplibre-gl:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-85061"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["maplibre-gl (\u003c= 6.4.0)"],"_cs_severities":["critical"],"_cs_tags":["web-security","xss","javascript"],"_cs_type":"advisory","_cs_vendors":["MapLibre"],"content_html":"\u003cp\u003eMapLibre GL JS versions 6.4.0 and below contain a critical vulnerability in the DOM.sanitize() function within src/util/dom.ts. The function attempts to sanitize user-supplied HTML strings by iterating over the element's attributes and removing those deemed dangerous. However, the implementation incorrectly iterates over the live NamedNodeMap (elem.attributes) while simultaneously calling elem.removeAttribute() within the same loop.\u003c/p\u003e\n\u003cp\u003eBecause NamedNodeMap is a live collection, removing an attribute shifts the index of all remaining attributes. This shift causes the iterator to skip the subsequent attribute in the list, allowing malicious attributes to bypass the filter. By crafting an HTML payload with consecutive dangerous attributes (such as \u003ccode\u003e\u0026lt;details open onload=\u0026quot;1\u0026quot; ontoggle=\u0026quot;...\u0026quot;\u0026gt;\u003c/code\u003e), an attacker can ensure one attribute is stripped while the next is preserved. This leads to zero-click XSS when the attribution string is subsequently injected into the application's DOM. This vulnerability affects any implementation rendering untrusted or third-party attribution strings.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for zero-click cross-site scripting (XSS) in the context of the application using MapLibre GL JS. This can lead to session hijacking, sensitive data theft, or arbitrary actions performed on behalf of the user. The vulnerability impacts any application that passes untrusted or user-supplied attribution strings through the map rendering engine.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to MapLibre GL JS version 6.4.1 or later immediately to incorporate the static attribute snapshot fix.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, implement server-side or pre-processing sanitization of attribution strings before they are passed to the map rendering component.\u003c/li\u003e\n\u003cli\u003eAudit application code for instances where third-party or user-controlled input is passed to map attribution settings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-08T21:49:15Z","date_published":"2026-09-08T21:49:15Z","id":"https://feed.craftedsignal.io/briefs/2026-09-maplibre-xss-bypass/","summary":"An improper iteration pattern over live NamedNodeMap objects in MapLibre GL JS allows attackers to bypass XSS sanitization by injecting consecutive malicious attributes, resulting in zero-click execution when rendered.","title":"MapLibre GL JS XSS Sanitizer Bypass in DOM.sanitize()","url":"https://feed.craftedsignal.io/briefs/2026-09-maplibre-xss-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - MapLibre","version":"https://jsonfeed.org/version/1.1"}