UpHeron
All vulnerabilities

npm

CVE-2026-85061

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

Severity
Critical 10.0
Published
8 Sept 2026
Last changed
8 Sept 2026
Added to UpHeron
14 Oct 2026
Fixed in
6.4.1
Also known as
GHSA-jrc7-96c5-q579
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
maplibre-glnpm · osv:npm:maplibre-gl
  • Every version before 6.4.1

References