CVE-2026-85061

Name of the Vulnerable Software and Affected Versions MapLibre GL JS versions prior to 6.4.1

Description The DOM.sanitize() function in src/util/dom.ts incorrectly iterates through elem.attributes as a live NamedNodeMap. Because removeAttributes() modifies the same collection during iteration, indexes shift, allowing adjacent dangerous attributes to be skipped. An attacker providing untrusted third-party style attribution strings or custom attributions can include consecutive dangerous attributes, such as onload or ontoggle, which may bypass sanitization and execute when the attribution control inserts content into innerHTML.

Recommendations Update MapLibre GL JS to version 6.4.1.