When a Map Credit Becomes Code: The Hidden XSS Trap in MapLibre GL JS

Introduction

A map widget can look harmless: a few tiles, a zoom bar, and a small credit line tucked into the corner of the screen. But in web security, the quietest UI elements can carry the most dangerous assumptions. A critical flaw in MapLibre GL JS shows how attribution content, if handled incorrectly, can cross the line from display text into executable browser code. The risk is not tied to the map itself so much as to the browser DOM logic that decides whether HTML stays safe.

Fast Facts

• CVE-2026-85061 tracks a critical XSS issue in MapLibre GL JS.
• Versions 6.4.0 and earlier are affected, while 6.4.1 addresses the issue.
• The vulnerable path is `DOM.sanitize()` in `src/util/dom.ts`.
• The attack path involves malicious map attribution content and can work without user interaction.
• The practical risk depends on whether an application renders untrusted or third-party attribution input.

What Went Wrong

The technical problem sits in a familiar but dangerous place: HTML sanitization. In this case, `DOM.sanitize()` reportedly iterated over a live attribute collection while removing attributes from the same element. That matters because live DOM collections can shift as items are deleted, which creates room for a dangerous attribute to slip past the filter.

From a defensive perspective, this is a classic sanitizer failure mode. The code is trying to clean markup, but the act of cleaning changes the object being inspected. If the wrong attribute survives, a browser may later interpret it as active content. In a mapping context, that becomes especially sensitive when attribution text is inserted into the page as HTML instead of plain text.

The broader security lesson is not limited to maps. Any feature that renders externally sourced metadata, credits, labels, or branding inside a trusted origin can become an XSS boundary if the input is not tightly controlled.

Why Zero-Click Matters

Zero-click XSS is more serious than a nuisance script bug because the victim does not need to press a button or open a malicious link. If a page loads and the vulnerable widget renders attacker-influenced attribution content, script execution can happen as part of normal display logic. That can put page data, authenticated actions, and in-browser session material at risk inside the site’s own origin.

At the time of writing, public information supports a risk analysis, not a definitive claim about every deployment. Exposure depends on whether an application accepts untrusted attribution content, and whether that content reaches the vulnerable rendering path.

Defensive Takeaway

Version 6.4.1 addresses the issue by snapshotting the attribute list before iteration, which avoids the live-collection trap. For operators, the immediate action is simple: upgrade affected installations, audit any custom attribution inputs, and treat map credits as security-sensitive content rather than decorative text. The deeper lesson is that small DOM helpers can have outsized consequences when they sit between untrusted input and the browser’s execution engine.

Conclusion

This case is a reminder that browser security failures often begin with something that looks routine. A map attribution line is not supposed to be an attack payload, but in a shared library, even a minor sanitization mistake can turn it into one. The safest assumption is that every rendered string is hostile until proven otherwise.

WIKICROOK

• Zero-click XSS: A cross-site scripting attack that can run without any user interaction.
• MapLibre GL JS: An open-source JavaScript library for rendering interactive web maps.
• DOM.sanitize(): The MapLibre sanitization helper implicated in the vulnerability.
• NamedNodeMap: A live browser collection of an element’s attributes.
• AttributionControl: The MapLibre UI component used to display map credits and attributions.