Search
Find a vulnerability
Search criteria
4 vulnerabilities by maplibre
CVE-2026-58505 (GCVE-0-2026-58505)
Vulnerability from nvd – Published: 2026-11-11 18:19 – Updated: 2026-11-13 17:34
VLAI
EPSS
VEX
Title
geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection
Summary
geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:31 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maplibre/geojson-vt/security/a… | x_refsource_CONFIRM |
| https://github.com/maplibre/geojson-vt/pull/156 | x_refsource_MISC |
| https://github.com/maplibre/geojson-vt/commit/cb8… | x_refsource_MISC |
| https://github.com/maplibre/geojson-vt/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| maplibre | geojson-vt |
Affected:
< 6.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58505",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:31:05.226138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:34:11.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "geojson-vt",
"vendor": "maplibre",
"versions": [
{
"status": "affected",
"version": "\u003c 6.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:19:59.296Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr"
},
{
"name": "https://github.com/maplibre/geojson-vt/pull/156",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/geojson-vt/pull/156"
},
{
"name": "https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82"
},
{
"name": "https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1"
}
],
"source": {
"advisory": "GHSA-75qh-632x-j5pr",
"discovery": "UNKNOWN"
},
"title": "geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58505",
"datePublished": "2026-11-11T18:19:59.296Z",
"dateReserved": "2026-06-30T20:21:25.813Z",
"dateUpdated": "2026-11-13T17:34:11.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85061 (GCVE-0-2026-85061)
Vulnerability from nvd – Published: 2026-09-03 20:18 – Updated: 2026-09-04 18:37
VLAI
EPSS
VEX
Title
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
Summary
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 18:36 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maplibre/maplibre-gl-js/securi… | x_refsource_CONFIRM |
| https://github.com/maplibre/maplibre-gl-js/pull/8189 | x_refsource_MISC |
| https://github.com/maplibre/maplibre-gl-js/commit… | x_refsource_MISC |
| https://github.com/maplibre/maplibre-gl-js/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| maplibre | maplibre-gl-js |
Affected:
< 6.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T18:36:59.472100Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:37:12.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "maplibre-gl-js",
"vendor": "maplibre",
"versions": [
{
"status": "affected",
"version": "\u003c 6.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T20:18:50.854Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579"
},
{
"name": "https://github.com/maplibre/maplibre-gl-js/pull/8189",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/maplibre-gl-js/pull/8189"
},
{
"name": "https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27"
},
{
"name": "https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1"
}
],
"source": {
"advisory": "GHSA-jrc7-96c5-q579",
"discovery": "UNKNOWN"
},
"title": "MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85061",
"datePublished": "2026-09-03T20:18:50.854Z",
"dateReserved": "2026-09-02T21:21:01.774Z",
"dateUpdated": "2026-09-04T18:37:12.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58505 (GCVE-0-2026-58505)
Vulnerability from cvelistv5 – Published: 2026-11-11 18:19 – Updated: 2026-11-13 17:34
VLAI
EPSS
VEX
Title
geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection
Summary
geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 17:31 UTC
CWE
- CWE-674 - Uncontrolled Recursion
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maplibre/geojson-vt/security/a… | x_refsource_CONFIRM |
| https://github.com/maplibre/geojson-vt/pull/156 | x_refsource_MISC |
| https://github.com/maplibre/geojson-vt/commit/cb8… | x_refsource_MISC |
| https://github.com/maplibre/geojson-vt/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| maplibre | geojson-vt |
Affected:
< 6.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58505",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T17:31:05.226138Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T17:34:11.310Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "geojson-vt",
"vendor": "maplibre",
"versions": [
{
"status": "affected",
"version": "\u003c 6.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable rendering and interacting with large geospatial datasets on the browser side (without a server). Prior to version 6.1.1, @maplibre/geojson-vt contains an uncontrolled recursion vulnerability in its GeoJSON conversion logic. When a GeoJSONVT instance is constructed with a deeply nested GeometryCollection object, the mutually recursive functions featureToInternal and convertGeometryCollection in src/convert.ts exhaust the Node.js call stack, causing an unhandled RangeError: Maximum call stack size exceeded that terminates the process. Because the library is widely used in server-side tile services that accept GeoJSON over the network, a remote unauthenticated attacker can trigger a denial-of-service by sending a single crafted payload. No authentication is required, and no non-default library options are needed. This issue has been patched in version 6.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-674",
"description": "CWE-674: Uncontrolled Recursion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T18:19:59.296Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/maplibre/geojson-vt/security/advisories/GHSA-75qh-632x-j5pr"
},
{
"name": "https://github.com/maplibre/geojson-vt/pull/156",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/geojson-vt/pull/156"
},
{
"name": "https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/geojson-vt/commit/cb85688270d80894ce377969c75e631fe4b04c82"
},
{
"name": "https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/geojson-vt/releases/tag/v6.1.1"
}
],
"source": {
"advisory": "GHSA-75qh-632x-j5pr",
"discovery": "UNKNOWN"
},
"title": "geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58505",
"datePublished": "2026-11-11T18:19:59.296Z",
"dateReserved": "2026-06-30T20:21:25.813Z",
"dateUpdated": "2026-11-13T17:34:11.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85061 (GCVE-0-2026-85061)
Vulnerability from cvelistv5 – Published: 2026-09-03 20:18 – Updated: 2026-09-04 18:37
VLAI
EPSS
VEX
Title
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
Summary
MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 18:36 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maplibre/maplibre-gl-js/securi… | x_refsource_CONFIRM |
| https://github.com/maplibre/maplibre-gl-js/pull/8189 | x_refsource_MISC |
| https://github.com/maplibre/maplibre-gl-js/commit… | x_refsource_MISC |
| https://github.com/maplibre/maplibre-gl-js/releas… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| maplibre | maplibre-gl-js |
Affected:
< 6.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T18:36:59.472100Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T18:37:12.250Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "maplibre-gl-js",
"vendor": "maplibre",
"versions": [
{
"status": "affected",
"version": "\u003c 6.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous attribute. An attacker who controls untrusted third-party style attribution strings or user-supplied custom attributions can supply consecutive dangerous attributes, causing an attribute such as onload or ontoggle to survive sanitization and execute when the attribution control inserts the content into innerHTML. A victim must render the affected map content for the script to execute. This issue is fixed in version 6.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T20:18:50.854Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579"
},
{
"name": "https://github.com/maplibre/maplibre-gl-js/pull/8189",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/maplibre-gl-js/pull/8189"
},
{
"name": "https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27"
},
{
"name": "https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1"
}
],
"source": {
"advisory": "GHSA-jrc7-96c5-q579",
"discovery": "UNKNOWN"
},
"title": "MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85061",
"datePublished": "2026-09-03T20:18:50.854Z",
"dateReserved": "2026-09-02T21:21:01.774Z",
"dateUpdated": "2026-09-04T18:37:12.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}