Description

A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-27T13:18:31.090Z",
  "pubdate": "2026-08-27T13:18:31.090Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the si-map component of Element maps-ng, affecting versions V47 (prior to V47.12.3), V48 (prior to V48.11.3), and V49 (prior to V49.16.1).\nThe vulnerability arises from the improper sanitization of the points property used in map pin tooltip rendering.\nSuccessful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript within the context of a victim's browser session.\nThis vulnerability poses a significant risk, as attackers can leverage it to perform session hijacking, sensitive data exfiltration, or unauthorized actions on behalf of the authenticated user.\nExploitation requires the victim to interact with the map by hovering over a malicious pin, which is triggered via a crafted URL or manipulated input data.\nOrganizations using these versions of Element maps-ng are at risk of client-side code execution if they do not sanitize user-controllable input or apply the necessary patches.\nRemediation requires upgrading to the specified patched versions to ensure proper input neutralization.",
  "technicalDetails": "The vulnerability is a classic DOM-based/Stored Cross-Site Scripting (XSS) flaw located within the si-map component of the Element maps-ng plugin. The root cause is the failure of the application to properly neutralize, encode, or sanitize user-controllable input provided via the points property.\nThis specific property is directly utilized by the component's rendering logic to populate the tooltip label associated with map pins. When a user interacts with the UI by hovering over a map pin, the application reflects the contents of the points property directly into the Document Object Model (DOM) without sufficient escaping of HTML/JavaScript characters.\nAttack flow: An attacker crafts a malicious input sequence—specifically embedding JavaScript within the points property—and embeds this into a URL or persistent data store consumed by the map component. When a victim loads the affected page, the malicious script payload is stored within the map configuration. Upon the victim triggering a mouseover event on the rendered map pin, the browser interprets the unsanitized input as executable script code rather than plain text.\nBecause the malicious script executes within the victim's current browser session, it inherits the victim's privileges, including access to session cookies, localStorage, and the ability to perform background API requests on behalf of the user.\nExploitation does not require prior authentication or high-level privileges; it relies on the application's trust in user-supplied map configuration data. The impact is significant, as it can be utilized for credential theft, unauthorized data modification, or redirecting the user to malicious external sites.\nThe vulnerable component is the si-map module, which lacks context-aware output encoding. By failing to treat the tooltip content as untrusted data, the application allows the breakout of the intended HTML container, facilitating script injection. As this is a client-side execution vector, the attack surface extends to any user who visits a page containing the manipulated map pin, making this a critical concern for public-facing web applications utilizing Element maps-ng."
}