Maplibre Gl Js
Monthly
Cross-site scripting in MapLibre GL JS before 6.4.1 lets an attacker who controls map style attribution strings or user-supplied custom attributions bypass the library's HTML sanitizer and run arbitrary JavaScript in the victim's browser. The flaw is a sanitizer bug in DOM.sanitize(): iterating the live attributes collection while deleting attributes shifts indexes, so a dangerous event handler placed immediately after another removed attribute (e.g. onload/ontoggle) survives cleaning and fires when the attribution control writes the content to innerHTML. No public exploit or KEV listing exists, but the fix commit ships working payloads (e.g. `<details open onload ontoggle=alert(1)>`) as regression tests, making a POC trivially reconstructable.
Cross-site scripting in MapLibre GL JS before 6.4.1 lets an attacker who controls map style attribution strings or user-supplied custom attributions bypass the library's HTML sanitizer and run arbitrary JavaScript in the victim's browser. The flaw is a sanitizer bug in DOM.sanitize(): iterating the live attributes collection while deleting attributes shifts indexes, so a dangerous event handler placed immediately after another removed attribute (e.g. onload/ontoggle) survives cleaning and fires when the attribution control writes the content to innerHTML. No public exploit or KEV listing exists, but the fix commit ships working payloads (e.g. `<details open onload ontoggle=alert(1)>`) as regression tests, making a POC trivially reconstructable.