SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
CVSS 3.1HIGH 8.6·Network·No auth·No interaction·EPSS 0.00427·Published 2026-01-30·Fixed in 1.1.2CWE-89