Vulnerability GHSA-9fpx-fr6j-2vh6
High Risk
HIGH RISK
CVSS Score: 8.8
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
20 hours ago
November 06, 2026 at 07:39 PM UTC
GeoNode has OS command injection via uploaded file layer name
2.0.dev20130913181950 - 5.0.3.post1
2.0.dev20130913181950 - 5.0.3.post1
Summary
GeoNode has OS command injection via uploaded file layer name
Details
Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
20 hours ago
GeoNode has Stored XSS in Documents metadata abstract field
2.0.dev20130913181950 - 5.0.2 GHSA-r4hm-p9f9-fj9v
2.0.dev20130913181950 - 5.0.2 GHSA-r4hm-p9f9-fj9v
Medium Risk
20 hours ago
GeoNode has Unrestricted File Upload
2.0.dev20130913181950 - 5.0.2 GHSA-fqpv-mq26-pr4j
2.0.dev20130913181950 - 5.0.2 GHSA-fqpv-mq26-pr4j
Medium Risk
3 months ago
GeoNode: Stored XSS to full account takeover
3.2.1 - 4.2.2 GHSA-rwcv-whm8-fmxm
3.2.1 - 4.2.2 GHSA-rwcv-whm8-fmxm
Medium Risk
5 months ago
GeoNode contains a server-side request forgery vulnerability in the service registration endpoint
4.0.0 - 4.4.4 and 5.0.0 - 5.0.1 GHSA-hw9r-6m78-w6h3
4.0.0 - 4.4.4 and 5.0.0 - 5.0.1 GHSA-hw9r-6m78-w6h3
Medium Risk
7 months ago
No summary available
4.0.0 - 4.4.4 and 5.0.0 - 5.0.1 PYSEC-2026-2159
4.0.0 - 4.4.4 and 5.0.0 - 5.0.1 PYSEC-2026-2159
Impacted packages
Timeline
Published
20 hours ago
November 06, 2026 at 07:39 PM UTC
Last Modified
20 hours ago
November 06, 2026 at 07:45 PM UTC