MapLibre GL JS versions prior to 6.4.1 are vulnerable to a critical cross-site scripting flaw that allows unauthenticated attackers to execute arbitrary scripts in a user's browser.

The vulnerability exists within the DOM.sanitize function located in src/util/dom.ts, where the library incorrectly iterates over a live NamedNodeMap while simultaneously removing attributes. This logic error allows an unauthenticated attacker to bypass sanitization filters by supplying consecutive malicious attributes, such as onload or ontoggle, which are subsequently executed when the content is inserted into innerHTML.

The exploitation of this vulnerability poses a severe risk to application integrity and user security. Because the flaw allows for arbitrary script execution, an attacker could potentially hijack user sessions, steal sensitive session tokens, or perform unauthorized actions on behalf of the victim. Given the CVSS score of 10.0, this issue is classified as critical, as it bypasses standard security controls to facilitate full compromise of the client-side session.

Immediate Action: Upgrade the maplibre-gl-js library to version 6.4.1 or later immediately to resolve the sanitization logic error.

Proactive Monitoring: Monitor web application logs for unusual attribution strings or unexpected client-side behavior occurring within map components.

Compensating Controls: Implement a strict Content Security Policy (CSP) that restricts script execution and prevents the loading of unauthorized external scripts as a defense-in-depth measure.

Public Exploit Available: No

This vulnerability represents a critical risk to any web application utilizing the MapLibre GL JS library for map rendering. Organizations must prioritize the update to version 6.4.1 to eliminate the sanitization failure. Failure to patch allows for trivial client-side code execution, necessitating immediate action by development and security teams to ensure the ongoing security of user sessions and data.