geonode
PyPI9 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting geonodepage 1 of 1
- CVE-2023-26043MEDIUMCVSS 6.5EG 6.5fixed in 4.0.32023-02-27
vulnerable: 2.0 ... 4.0.2 (211 versions)
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to …
- CVE-2023-40017HIGHCVSS 7.5EG 7.5fixed in 4.2.0 or 4.1.3, by version range2023-08-24
vulnerable: 3.2.0 ... 4.1.2 (23 versions)
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery…
- CVE-2023-42439HIGHCVSS 6.5EG 7.5fixed in 4.1.3.post12023-09-15
vulnerable: 3.2.0 ... 4.4.3 (40 versions)
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user …
- CVE-2024-27091MEDIUMCVSS 6.1EG 6.1fixed in 4.2.32024-03-27
vulnerable: 3.2.1 ... 4.2.2 (29 versions)
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies ar…
- CVE-2026-33050HIGHCVSS 8.8EG 8.8fixed in 5.1.02026-11-06
vulnerable: 2.0 ... 5.0.3.post1 (239 versions)
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shel…
- CVE-2026-39921MEDIUMCVSS 6.3EG 6.3fixed in 4.4.5 or 5.0.2, by version range2026-04-10
vulnerable: 4.0.0 ... 5.0.1 (28 versions)
GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger arbitrary outbound HTTP requests by providing a maliciou…
- CVE-2026-39922MEDIUMCVSS 6.3EG 6.3fixed in 4.4.5 or 5.0.2, by version range2026-04-10
vulnerable: 4.0.0 ... 5.0.1 (28 versions)
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests…
- CVE-2026-46429MEDIUMCVSS 5.5EG 5.5fixed in 5.0.32026-11-06
vulnerable: 2.0 ... 5.0.2 (237 versions)
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged rem…
- CVE-2026-55649MEDIUMCVSS 6.3EG 6.3fixed in 5.0.32026-11-06
vulnerable: 2.0 ... 5.0.2 (237 versions)
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persis…
Check whether geonode is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for geonode CVEs against the assets you own.
Book a Demo →