Description
DOM.sanitize() in src/util/dom.ts iterated elem.attributes (a live NamedNodeMap) while calling elem.removeAttribute() in the same loop. Removing an attribute shifts subsequent attributes down by one index, causing the iterator to skip the adjacent attribute.
Recommendation
Update the maplibre-gl package to the latest compatible version. Followings are version details:
- Affected version(s): <= 6.4.0
- Patched version(s): 6.4.1
References
Could your website be exposed too?
SmartScanner can check your website for MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) - CVE-2026-113657
- SunEditor: Critical XSS vulnerability - sanitizer bypass - CVE-2026-59167
- TeleJSON: DOM XSS via unsanitised constructor name in `new Function()` - CVE-2026-47099
- sanitize-html allowedTags Bypass via Entity-Decoded Text in nonTextTags Elements - CVE-2026-40186
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026