maplibre-gl npm Package XSS Vulnerability: What We Know
- Severity
- HIGH
- Affected component
- maplibre-gl (npm)
- Affected versions
- <= 6.4.0
- Patched version
- 6.4.1
An early warning has been issued for a cross-site scripting vulnerability in the maplibre-gl npm package affecting versions up to 6.4.0.
What happened
An early warning has been issued for a critical cross-site scripting (XSS) vulnerability in the maplibre-gl npm package. This vulnerability, tracked as GHSA-JRC7-96C5-Q579 and CVE-2026-85061, is due to a sanitizer bypass in the DOM.sanitize() function. It allows an attacker to execute arbitrary HTML attributes in a zero-click manner. The vulnerability affects versions of maplibre-gl up to 6.4.0. The issue has been patched in version 6.4.1.
The vulnerability was first flagged on September 8, 2026. It is currently under investigation and has not been reported as exploited in the wild. Users of the affected versions are advised to upgrade to the patched version to mitigate the risk.
What to do about it
- Upgrade your maplibre-gl npm package to version 6.4.1 or later to mitigate the XSS vulnerability.
- Review your application for any instances where user-supplied data is rendered in the DOM and ensure proper sanitization is in place.
- Monitor the primary sources for updates on this vulnerability and any additional patches that may be released.
How 0Day would have caught this
maplibre-gl is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using maplibre-gl npm package version 6.4.0 or earlier.
What should I do right now?
Upgrade to maplibre-gl version 6.4.1 or later to mitigate the XSS vulnerability.
Has this been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.