GHSA-jrc7-96c5-q579: XSS
Impact DOM.sanitize() in src/util/dom.ts iterated elem.attributes (a live NamedNodeMap) while calling elem.removeAttribute() in the same loop. Removing an attribute shifts subsequent attributes down by one index, causing the iterator to skip the adjacent attribute.
An attacker can provide an HTML payload with consecutive dangerous attributes (such as <details open onload="1" ontoggle="...">). The first attribute is stripped while the second survives and executes upon insertion into innerHTML via the attribution control without requiring user interaction (zero-click XSS).
Applications rendering untrusted/third-party style attribution strings or user-supplied custom attributions are impacted.
Patches The issue has been resolved by creating a static snapshot of attributes using Array.from(elem.attributes) before iteration. Please upgrade to maplibre-gl version 6.4.1 (or latest).
Workarounds Sanitizing the attribute field of a source before passing it down to maplibre
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/maplibre-glto a version that resolves this vulnerability.Fixed in 6.4.1 - Upgrade
Upgrade
maplibre-glto a version that resolves this vulnerability.Fixed in 6.4.1 - Configuration
In DOM.sanitize() (src/util/dom.ts), change the loop to iterate over a static snapshot created with Array.from(elem.attributes), instead of iterating directly over the live NamedNodeMap while removing attributes. This prevents skipping/incorrect handling of consecutive attributes (e.g., dangerous ones) during sanitization.
maplibre-gl (DOM.sanitize in src/util/dom.ts) attribute iteration method = Use Array.from(elem.attributes) to create a static snapshot before calling elem.removeAttribute()
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Applications using maplibre-gl that render untrusted or third-party style attribution strings, or user-supplied custom attributions, are impacted. The vulnerable attribution content is inserted into innerHTML.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted HTML attribution payload containing consecutive dangerous attributes. No authentication or user interaction is required for the described zero-click XSS path.
What should be done if an immediate upgrade is not possible?
Sanitize the attribute field of a source before passing it to maplibre. This reduces exposure from untrusted attribution content until the package can be upgraded.
What version remediates the issue?
Upgrade maplibre-gl to version 6.4.1 or later. The fix snapshots the element attributes before removing unsafe ones, preventing adjacent attributes from being skipped.