Read the docs
TI-2024-17952 Aliases CVE-2024-27091GHSA-rwcv-whm8-fmxm

GeoNode stored XSS to full account takeover

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed geonode (GeoNode): 4.2.3geonode (PyPI): 4.2.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GeoNodegeonode3.2.0 to before 4.2.34.2.3Patch availableCNA
—geonode (PyPI)3.2.1 to before 4.2.34.2.3Patch availableGHSA-rwcv-whm8-fmxm
  • geonode VendorGeoNode Affected 3.2.0 to before 4.2.3 Fixed in 4.2.3 Patch available CNA
  • geonode (PyPI) Vendor— Affected 3.2.1 to before 4.2.3 Fixed in 4.2.3 Patch available GHSA-rwcv-whm8-fmxm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:geosolutionsgroup:geonode:*:*:*:*:*:*:*:*after 3.2.0, before 4.2.3VulnerableGeoNode
  • cpe:2.3:a:geosolutionsgroup:geonode:*:*:*:*:*:*:*:* Versions after 3.2.0, before 4.2.3 Vulnerable ·GeoNode

Remediation

  • Fix · CNA geonode (GeoNode) Fixed in 4.2.3
  • Fix · GHSA-rwcv-whm8-fmxm geonode (PyPI) Fixed in 4.2.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-27091
  2. 2026-10-03 Alias added: GHSA-rwcv-whm8-fmxm

References

Patch 1

Advisory 2

Other 2

  • TI-2023-22605 GeoNode SSRF Bypass to return internal host data CVSS 3.1HIGH 7.5
  • TI-2023-11277 XML External Entity (XXE) injection in GeoServer style upload functionality CVSS 3.1MEDIUM 6.5
  • TI-2023-20907 Geonode Server Side Request Forgery vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-12986 Geoserver for GeoNode sensitive information leak CVSS 3.1HIGH 7.5
  • TI-2026-28791 GeoNode SSRF via Service Registration CVSS 4.0MEDIUM 5.3
  • TI-2026-28790 GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences