Description

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-03T21:17:23.323Z",
  "pubdate": "2026-09-03T21:17:23.323Z",
  "executiveSummary": "MapLibre GL JS versions prior to 6.4.1 are susceptible to a Cross-Site Scripting (XSS) vulnerability stemming from improper DOM element sanitization.\nThe vulnerability type is an iteration-based security bypass within the sanitization logic.\nSuccessful exploitation allows an attacker to inject and execute arbitrary JavaScript by manipulating untrusted style attribution strings.\nThe impact is significant, as it enables attackers to perform unauthorized actions within the victim's browser session, potentially leading to data exfiltration or session hijacking.\nThe attack is contingent upon the victim rendering map content containing the malicious attribution strings, which are then processed by the vulnerable DOM.sanitize() function.\nThis flaw originates in the handling of live collections during attribute removal, representing a logic error in security filtering.\nThe risk is categorized as high, particularly for applications that dynamically ingest map metadata or user-provided style configurations.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the DOM.sanitize() function located in src/util/dom.ts.\nThe function iterates over elem.attributes, which returns a live NamedNodeMap object. In the Document Object Model (DOM), a NamedNodeMap is a live collection; any changes made to the element's attributes directly impact the contents and indexing of this collection.\nDuring the sanitization process, the function performs a loop to inspect attributes. When a dangerous attribute is identified, the logic calls removeAttributes() to strip it from the element.\nBecause the iteration is performed on a live collection, removing an attribute causes the remaining attributes to shift, effectively re-indexing the NamedNodeMap.\nIf an attacker provides a series of malicious, consecutive attributes (e.g., 'onload' followed by another 'onerror'), the removal of the first attribute shifts the subsequent attribute into the index currently being processed by the loop. Consequently, the loop iterator increments, and the sanitization logic skips the newly shifted, dangerous attribute.\nThis flaw enables the survival of malicious attributes that should have been removed. When the attribution control subsequently inserts the unsanitized element into the DOM via innerHTML, the browser parses the surviving malicious attributes.\nFor example, an attacker can craft a payload within third-party style attribution strings or user-supplied custom attributions containing multiple dangerous event handlers. Upon rendering, the browser executes the injected JavaScript code, fulfilling the XSS attack vector.\nThe vulnerability affects all versions of MapLibre GL JS prior to 6.4.1. The attack requires no authentication or special privileges on the part of the attacker, as it relies on the processing of untrusted content that is intentionally rendered by the MapLibre component. The exposure is client-side, triggered whenever a victim views a map containing the crafted malicious attribution data."
}