MAPLIBRE GL JS has a critical XSS flaw, CVE-2026-85061, affecting applications that render untrusted map styles or custom attributions. The vulnerability sits in the library prior to version 6.4.1 and is described as a sanitizer bypass in DOM[.]sanitize() via a Live NamedNodeMap removal skip. MapLibre GL JS is widely used for web mapping, with around 2.7 million weekly downloads, amplifying the potential impact of a zero-click exploit.
According to the security notice, there is no confirmed exploitation in the wild at present, and public PoCs do not yet exist. The patch was issued in version 6.4.1, with guidance to upgrade immediately to 6.4.1 or the latest release (6.8.0 as noted). If immediate patching is not possible, administrators are advised to sanitise the attribute field of a source before passing it to MapLibre. The advisory notes an EPSS of 0.3% over 30 days, underscoring the urgency of remediation for any site rendering third-party map data.