CVE-2026-85061

MapLibre GL JS (an interactive vector tile map library for web browsers) is vulnerable to an XSS sanitizer bypass in DOM.sanitize() (src/util/dom.ts). Prior to 6.4.1 , the function iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes entries from the same collection, c...