Loading story…
MapLibre GL JS versions 6.4.0 and earlier contain CVE-2026-85061 (GHSA-jrc7-96c5-q579), a critical cross-site scripting flaw that can permit zero-click JavaScript execution in applications rendering attacker-controlled map data. The defect lies in DOM.sanitize(), which removes attributes while iterating over a live NamedNodeMap; index shifts can cause consecutive malicious attributes, including event handlers, to evade sanitization before content is inserted through innerHTML.
An attacker can deliver crafted HTML via untrusted map-style metadata, attribution text, or custom attribution fields without requiring authentication, privileges, or user interaction. Successful exploitation can support session theft, unauthorized actions, data exposure, phishing redirects, and map-content manipulation. MapLibre corrected the issue in version 6.4.1 by processing a static copy of element attributes; organizations should upgrade and review applications that ingest untrusted mapping metadata or attribution content.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
MapLibre maintainers fixed CVE-2026-85061 in maplibre-gl version 6.4.1 by making a static copy of element attributes before inspecting and removing unsafe attributes.
CVE-2026-85061 (GHSA-jrc7-96c5-q579) was identified in MapLibre GL JS versions 6.4.0 and earlier. The DOM.sanitize() routine could skip adjacent malicious attributes while iterating over a live NamedNodeMap, permitting zero-click JavaScript execution through untrusted attribution or map metadata.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Grafana disclosed a cross-site scripting (XSS) vulnerability in the **Geomap MapLibre** component of Grafana OSS. Affected versions are `12.3.0` through `12.4.10`, `13.0.0` through `13.0.8`, `13.1.0` through `13.1.5`, and `13.2.0` through `13.2.1`. The Canadian Centre for Cyber Security and Guyana National CIRT advised administrators to review Grafana’s security advisory and apply available updates. The published notices did not specify a CVE identifier, severity rating, exploitation status, technical exploitation details, or the remediated release versions.
Sep 18, 2026
A high-severity stored cross-site scripting vulnerability, **GHSA-7w8c-qgxg-m7jx** (CWE-79), affects LibreNMS legacy PHP templates that render monitoring data without consistent output encoding. Attackers able to control SNMP metadata, spoof Syslog messages, or supply crafted BGP descriptions can store JavaScript payloads that execute when administrators view device-health, routing, or event-log pages, potentially compromising administrator browser sessions and enabling session takeover. Organizations should update LibreNMS and related packages to version **26.5.0** or later; Tenable Cloud Security plugin **446367** can identify affected `librenms/librenms` deployments. Developers should apply contextual output encoding, including Laravel's `e()` helper or escaped Blade `{{ ... }}` syntax rather than raw output, and deploy a restrictive Content Security Policy as defense in depth. No known exploitation has been reported.
Aug 26, 2026
A vulnerability tracked as **CVE-2026-44990** allows stored cross-site scripting in `sanitize-html` when applications use the library’s default configuration and later render sanitized user content as trusted HTML. The flaw affects versions prior to **2.17.4** and stems from the handling of the disallowed `xmp` element: because `htmlparser2` treats `xmp` as a raw-text tag, attacker-supplied markup inside it is preserved as text during sanitization but can be emitted back as active HTML or JavaScript under the default `disallowedTagsMode: 'discard'` behavior. GitHub’s advisory and the upstream patch say the bypass can let payloads such as `<script>`, `img` event handlers, and `svg`-embedded script content survive filtering and execute in a victim’s browser. The fix in **2.17.4** adds `xmp` to `nonTextTags` so content inside a disallowed `xmp` tag is dropped instead of re-emitted, and regression tests were added to confirm the malicious content is removed. The issue was reported by **Vincenzo Turturro** (`sushi-gif`), and users of affected `sanitize-html` deployments, including those in **ApostropheCMS**, were urged to update immediately.
Jun 29, 2026