npm/maplibre-gl CVE-2026-85061: critical 10, EPSS 0.52%

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

Action: Upgrade maplibre-gl to 6.4.1 or later.

npm i maplibre-gl@6.4.1

Affected

Fixed versions

Sources

• osv: GHSA-jrc7-96c5-q579
• https://github.com/maplibre/maplibre-gl-js/security/advisories/GHSA-jrc7-96c5-q579
• https://nvd.nist.gov/vuln/detail/CVE-2026-85061
• https://github.com/maplibre/maplibre-gl-js/pull/8189
• https://github.com/maplibre/maplibre-gl-js/commit/1da69f3cd913a39fa948708e01478663bf48bc27
• https://github.com/maplibre/maplibre-gl-js
• https://github.com/maplibre/maplibre-gl-js/releases/tag/v6.4.1

CVE-2026-85061 · published 2026-09-08T20:50:47Z · modified 2026-09-08T21:00:06.120859507Z · JSON