Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-33050 · GHSA-9fpx-fr6j-2vh6

GeoNode has OS command injection via uploaded file layer name

Risk score
58/100
CVSS
8.8 v3.1
Published
6 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. …
Affected
GeoNode (pip) < 5.1.0
Fix
Upgrade GeoNode to 5.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: GeoNodeTHE FLAWSTHE FIXCVE-2026-33050GeoNode has OS commandinjection via uploaded file layernameCVSS 8.8CVE-2026-55649GeoNode has Stored XSS inDocuments metadata abstractfieldCVSS 6.3Upgrade GeoNode5.1.0 · 5.0.3or later on your release lineWho is exposedGeoNode (pip) < 5.1.0YELLOW · PLAN IT INGeoNodeGeoNode is a geospatial contentmanagement system, a platformfor the management andpublication of geospatial data.Prior to 5.1.0, a crafted vectorfile layer name supplied duringupload allows a low-privileged…Where it standsNo known exploitationCONNECTS TOSame weaknessOS command injection (CWE-78)400 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

GeoNode: Yellow, plan it in. GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. …

The flaws

  • CVE-2026-33050: GeoNode has OS command injection via uploaded file layer name (CVSS 8.8)
  • CVE-2026-55649: GeoNode has Stored XSS in Documents metadata abstract field (CVSS 6.3)

The fix

Upgrade GeoNode: 5.1.0 · 5.0.3 or later on your release line

Who is exposed: GeoNode (pip) < 5.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.8 high
  • On your watchlist: PyPI

Affected packages

PackageEcosystemVulnerableFixed in
GeoNodepip< 5.1.05.1.0

References

Original description

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.

Last activity 6 Nov 2026. Patch Forecast updates every hour.