AttributionControl is the MapLibre UI component that displays map credits, source attributions, and related metadata on the page. In normal use it is a small, low-profile part of the map interface, but it sits on a sensitive boundary: it turns externally supplied attribution text into browser-rendered content. If that content is handled as HTML instead of plain text, it can become an execution path rather than a label.
In cyber security, this matters because attribution fields often come from map data, tiles, or third-party services that developers do not fully control. A weak sanitizer or unsafe DOM update inside AttributionControl can let an attacker inject markup or script, creating cross-site scripting risk. Defenders should treat attribution input as untrusted, prefer text-only rendering where possible, and keep MapLibre updated so sanitizer fixes and DOM handling improvements are applied.