GHSA-JRC7-96C5-Q579 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

Impact DOM.sanitize in src/util/dom.ts iterated elem.attributes a live NamedNodeMap while calling elem.removeAttribute in the same loop. Removing an attribute shifts subsequent attributes down by one index, causing the iterator to skip the adjacent attribute. An attacker can provide an HTML paylo...

CVE-2026-85061 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous...

CVE-2026-85061

MapLibre GL JS (an interactive vector tile map library for web browsers) is vulnerable to an XSS sanitizer bypass in DOM.sanitize() (src/util/dom.ts). Prior to 6.4.1 , the function iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes entries from the same collection, c...