Critical MapLibre GL JS Vulnerability Enables Zero

Gbhackers •Divya • September 9, 2026

MapLibre GL JS users are advised to upgrade their software following the disclosure of an XSS vulnerability, identified as CVE-2026-85061 and documented in GitHub advisory GHSA-jrc7-96c5-q579. This vulnerability affects maplibre-gl versions 6.4.0 and earlier and is resolved in version 6.4.1. Critical MapLibre GL JS Flaw The issue lies in the DOM.sanitize() function in src/util/dom.ts, which […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical MapLibre GL JS Vulnerability Exposes Millions to Zero-Click Attacks A critical cross-site scripting vulnerability, CVE-2026-85061, has been disclosed in the MapLibre GL JS library, affecting versions 6.4.0 and earlier. This flaw allows for potential zero-click attacks, putting approximately 2.7 million users at risk. The vulnerability is rooted in the DOM.sanitize() function, which fails to properly sanitize user input. Users are strongly advised to upgrade to version 6.4.1, which addresses this issue. The vulnerability was published on September 3, 2026, and is documented in GitHub advisory GHSA-jrc7-96c5-q579. The widespread use of MapLibre GL JS in web applications amplifies the potential impact of this flaw. Organizations utilizing this library should prioritize patching to mitigate risks associated with this vulnerability. 2 sources 71

Extracted Entities

Critical MapLibre GL JS Vulnerability Enables Zero

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)