Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-04 | 2 | Disclosure1General1 |
| 2026-09-09 | 3 | Disclosure1Patch2 |
| 2026-09-11 | 1 | Patch1 |
| 2026-09-12 | 1 | General1 |
| 2026-09-15 | 1 | Exploit1 |
| 2026-09-17 | 1 | Patch1 |
اول ثغرة رسمية لي، و القادم أروع (: https://www.cve.org/CVERecord?id=CVE-2026-85061
Post summary
The user shares a link to CVE‑2026‑85061 without providing any exploit details, patches, or evidence of active exploitation.
A critical MapLibre XSS vulnerability allows zero-click code execution in 2.7M weekly downloads. Discover how CVE-2026-85061 works and how to patch now. #MapLibre #XSS #CVE202685061 #WebSecurity #InfoSec #CyberSecurity #OpenSource https://securityonline.info/maplibre-xss-vulnerability/ https://t.co/L2ScbLitCd
Post summary
The tweet points out a critical XSS flaw in MapLibre that allows zero‑click code execution and urges users to apply the available patch immediately.
Security advisory for maplibre-gl (#79 in npm's top 100). CVE-2026-85061 (critical): MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() 60% of last week's downloads (4.3M) went to affected versions. Update to 6.4.1 or later. https://github.com/advisories/GHSA-jrc7-96c5-q579 https://t.co/GUDSA3h5Bf
Um loop que remove item da lista enquanto percorre ela. Esse bug de primeiro semestre virou um XSS nota 10 numa biblioteca de mapa usada no mundo inteiro. É o CVE-2026-85061, no MapLibre GL JS. A parte afetada é a atribuição, ou seja, aquele texto de crédito no canto do mapa. Esse texto vem de fora, do style JSON ou do servidor de tiles. Por isso ele passa por um sanitizer antes de virar HTML. O sanitizer percorre os atributos do elemento e remove os perigosos, tipo qualquer coisa começando com "on". Só que elem.attributes é uma coleção viva. Quando você remove o atributo da posição 1, o da posição 2 desliza pra 1. E o loop já foi pra posição 2. O atributo que deslizou nunca é olhado. Então o payload é uma tag details com o atributo open, um onload e um ontoggle, nessa ordem. O onload é removido, e o ontoggle sobrevive. Um details com open dispara o ontoggle no instante em que entra na página. Ninguém clica em nada. Corrigido na 6.4.1, em agosto. O CVE saiu em setembro. Aqui entra a defesa em camada. Um CSP com script-src sem 'unsafe-inline' faz o navegador recusar o ontoggle, mesmo com o sanitizer furado. A CarameloSec lê o seu CSP e diz se o script-src está fechado. Você ajusta, roda de novo e vê a correção comprovada. Vai ver como está o seu: http://caramelosec.com 🐕 #bolhasec #bolhadev
Post summary
The post explains a live-collection iteration bug in MapLibre GL JS (CVE-2026-85061) that enables XSS via a crafted details tag payload, notes a fix in version 6.4.1, and recommends CSP as a defensive measure.
[CVE] CVE-2026-85061 [HIGH PRIORITY] #MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap ... 🔗 https://exploitgrid.net/cve/CVE-2026-85061
Post summary
The post announces the discovery of CVE-2026‑85061, outlining it as an XSS sanitizer bypass in MapLibre GL JS’s DOM.sanitize(), and provides a link likely containing a PoC.
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-70352 CVE-2026-75754 CVE-2026-83711 CVE-2026-85061 CVE-2026-11613 ..🧵👇
Post summary
The excerpt only lists CVE identifiers without providing any additional context or details about the vulnerabilities.
MapLibre の XSS 脆弱性 CVE-2026-85061 が FIX：サニタイザーの不備によるゼロクリック攻撃 https://iototsecnews.jp/2026/09/09/maplibre-vulnerability-exposes-2-7m-users-to-zero-click-attacks/ MapLibre GL JS における DOM 無害化処理の実装不備に起因するクロスサイト・スクリプティングの脆弱性 CVE-2026-85061 が報告されています。要素の属性を動的コレクションから直接削除する実装により、危険な属性の連続時に検査漏れが生じる背景が存在します。これにより、外部の地図データを処理するアプリケーションにおいて、ユーザー操作なしで任意のスクリプトが実行されるおそれがあります。影響としてはセッションの窃取／機密データへのアクセス／表示内容の改ざんなどが挙げられます。対応策として、内部処理の安全性確保／バージョン 6.4.1 以降への速やかなアップグレード／外部入力の無害化実施が求められます。 #CVE202685061 #MapLibre #Vulnerability
Post summary
The tweet discloses CVE-2026-85061, an XSS flaw in MapLibre GL JS, and recommends upgrading to version 6.4.1 or later as a patch.
MapLibre GL JSにCVSS 10.0のXSS脆弱性「CVE-2026-85061」、6.4.1で修正 https://rocket-boys.co.jp/security-measures-lab/maplibre-gl-js-cve-2026-85061-update/ #セキュリティ対策Lab #security #securitynews #セキュリティ
Post summary
The post indicates that MapLibre GL JS had a severe XSS flaw (CVE-2026-85061, CVSS 10.0) which is now resolved in version 6.4.1.
MapLibre GL JSに、利用者操作なしでJavaScriptを実行できるCriticalのXSS脆弱性「CVE-2026-85061」が見つかった。影響は6.4.0以前で、地図のattributionなどに細工したHTMLを渡すことで発火する。 原因はDOM.sanitize()が要素の属性をliveなNamedNodeMapのまま走査し、危険な属性を削除していた実装にある。属性削除でindexがずれ、直後の悪性イベントハンドラを検査せず残してしまう場合があった。 GitHubの例では、details要素にopen、onload、ontoggleなどを連続して設定すると、1つを削除した後に隣接する属性が残り、MapLibreがinnerHTMLへ挿入した際に自動実行される。 攻撃に認証や利用者操作は不要。第三者のmap styleやattribution、利用者指定のcustom attributionを扱うサービスが影響を受ける可能性がある。修正版は6.4.1で、属性をArray.from(elem.attributes)で静的コピーしてから処理するよう変更された。 https://cybersecuritynews.com/maplibre-zero-click-vulnerability/
Post summary
CVE-2026-85061 is a critical, zero‑click XSS in MapLibre GL JS pre‑6.4.1, with a GitHub PoC example and a fix released in 6.4.1.
🚨Critical - MapLibre GL JS XSS via DOM.sanitize() Live NamedNodeMap Bypass (CVE-2026-85061) MapLibre GL JS DOM.sanitize() iterates a live NamedNodeMap while removing attributes, letting adjacent dangerous attrs be skipped. If an attacker controls untrusted style attribution strings/custom attributions, crafted consecutive attributes can survive sanitization and execute when inserted into innerHTML. 👉Affected: maplibre-gl < 6.4.1 | Upgrade to 6.4.1
Post summary
Critical XSS vulnerability (CVE‑2026‑85061) in MapLibre GL JS <6.4.1 allows script execution via crafted attributes bypassing DOM.sanitize(); upgrade to version 6.4.1 is advised.