AIKIDO-2026-516712
maplibre-gl is vulnerable to Cross-Site Scripting (XSS)
82
High Risk
This Affects:
maplibre-glTL;DR
The DOM.sanitize helper strips disallowed attributes while iterating directly over an element's live attribute collection. Because each removal shifts the remaining attributes down by one index, the loop skips the attribute immediately after a removed one and leaves it in place. Untrusted markup carrying consecutive dangerous attributes, such as a <details> element with back-to-back event-handler attributes, can therefore retain an executable handler that fires when the sanitized content is inserted into the page. The fix snapshots the attribute collection with Array.from before iterating so every disallowed attribute is removed.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application renders untrusted or user-supplied HTML, such as custom attribution strings, that the map sanitizes and inserts into the page.
Background info
maplibre-gl is vulnerable to Cross-Site Scripting (XSS) in versions 5.0.0 - 6.4.0.
How to fix this
Upgrade the maplibre-gl library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant