EUVD-2026-70734

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize via Live NamedNodeMap Removal Skip...

PT-2026-85245

Name of the Vulnerable Software and Affected Versions MapLibre GL JS versions prior to 6.4.1 Description The DOM.sanitize function in src/util/dom.ts incorrectly iterates through elem.attributes as a live NamedNodeMap. Because removeAttributes modifies the same collection during iteration, indexe...