CVE-2026-55649 · GHSA-r4hm-p9f9-fj9v
GeoNode has Stored XSS in Documents metadata abstract field
- Risk score
- 43/100
- CVSS
- 6.3 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the…
- Affected
- GeoNode (pip) < 5.0.3
- Fix
- Upgrade GeoNode to 5.0.3 or later.
- Exploitation
- No known exploitation
Story map
At a glance
GeoNode: Yellow, plan it in. GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. …
The flaws
- CVE-2026-55649: GeoNode has Stored XSS in Documents metadata abstract field (CVSS 6.3)
- CVE-2026-33050: GeoNode has OS command injection via uploaded file layer name (CVSS 8.8)
The fix
Upgrade GeoNode: 5.0.3 · 5.1.0 or later on your release line
Who is exposed: GeoNode (pip) < 5.1.0
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 400 other warnings in 30 days
Why it is Yellow
- CVSS 6.3 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| GeoNode | pip | < 5.0.3 | 5.0.3 |
References
- https://github.com/advisories/GHSA-r4hm-p9f9-fj9v
- https://github.com/GeoNode/geonode/security/advisories/GHSA-r4hm-p9f9-fj9v
- https://github.com/GeoNode/geonode/pull/14322
- https://github.com/GeoNode/geonode/pull/14343
- https://github.com/GeoNode/geonode/commit/0803857b22eba5b55729145ef401b1bc1c23e332
- https://github.com/GeoNode/geonode/commit/730d8fae206ea5b051f630718aeecae1bf7b5760
- https://github.com/GeoNode/geonode/releases/tag/5.0.3
- https://github.com/advisories/GHSA-r4hm-p9f9-fj9v
Original description
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.
Last activity 6 Nov 2026. Patch Forecast updates every hour.