CVE-2026-85061
CriticalCVSS 10.0Summary
MapLibre GL JS prior to 6.4.1 has a vulnerability in DOM.sanitize() in src/util/dom.ts, which iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
Risk Assessment
An attacker can execute script in the victim's browser context, potentially leading to data theft, session hijacking, or other XSS attacks.
Recommendation
Immediately update MapLibre GL JS to version 6.4.1 or later and avoid rendering untrusted attribution content.
Related vulnerabilities
- CVE-2026-85440Critical
Pre-authentication heap overflow vulnerability in MOOS core-moos through 10.4.0 in MOOSCommPkt packet handling. Attackers can declare a negative packet length, leading to writing arbitrary data past a four-byte heap buffer during the HandShake phase.
- CVE-2026-85438Critical
Buffer overflow vulnerability in MOOS-IvP through 24.8.1 in StringToIvPFunction(), where dimension, piece, and degree counts from encoded BHV_IPF payloads are used without validation. Attackers can supply crafted payloads to write past the IvPBox weight array.
- CVE-2026-85437Critical
Multiple buffer overflow vulnerabilities in MOOS-IvP through 24.8.1 in IvP function string decoders that trust attacker-controlled length fields. Crafted encoded strings can overflow heap and stack buffers, potentially enabling remote code execution.
- CVE-2026-85435Critical
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages, allowing any publisher to enroll attacker-controlled shore routes. Attackers can receive bridged vehicle traffic including sensor data and control information.
- CVE-2026-85434Critical
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
- CVE-2026-85433Critical
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted messages to open new listeners and redirect or duplicate traffic.
- CVE-2026-85430Critical
MOOS essential-moos through 10.0.1 contains an authentication bypass in pShare that accepts UDP datagrams from any source and republishes them with attacker-claimed identity. Attackers can inject messages under spoofed identities or crash the pShare process.
- CVE-2026-85428Critical
MOOS core-moos through 10.4.0 contains an authentication bypass in the optional MOOSDB HTTP server, allowing unauthenticated clients to write variables. Attackers can modify MOOS variables including actuator and override commands without authentication.
- CVE-2026-85426Critical
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters to execute arbitrary commands as the uMemWatch process user.
- CVE-2026-85425Critical
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish messages with command substitution syntax to execute arbitrary commands as the iSay process user.
Original NVD description (English source)
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.