Read the docs
TI-2026-86095 Aliases CVE-2026-33050GHSA-9fpx-fr6j-2vh6

OS command injection in GeoNode via uploaded vector layer name

Priority LOW 39CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

GeoNode before 5.1.0 is affected, including the PyPI package GeoNode before 5.1.0. A crafted vector file layer name supplied during upload is passed to an operating system command without neutralizing special elements (CWE-78). A remote user with low privileges can inject shell syntax and run arbitrary operating system commands on the GeoNode server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.

Why it matters now

EPSS 0.00653 51st percentileScored 2026-11-07
Fix Fixed geonode (GeoNode): 5.1.0GeoNode (PyPI): 5.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
GeoNodegeonodebefore 5.1.05.1.0Patch availableCNA
—GeoNode (PyPI)before 5.1.05.1.0Patch availableGHSA-9fpx-fr6j-2vh6
  • geonode VendorGeoNode Affected before 5.1.0 Fixed in 5.1.0 Patch available CNA
  • GeoNode (PyPI) Vendor— Affected before 5.1.0 Fixed in 5.1.0 Patch available GHSA-9fpx-fr6j-2vh6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:geosolutionsgroup:geonode:*:*:*:*:*:*:*:*——GeoNode
  • cpe:2.3:a:geosolutionsgroup:geonode:*:*:*:*:*:*:*:* Versions — — ·GeoNode

Remediation

The geonode product and the PyPI GeoNode package are fixed in version 5.1.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA geonode (GeoNode) Fixed in 5.1.0
  • Fix · GHSA-9fpx-fr6j-2vh6 GeoNode (PyPI) Fixed in 5.1.0 Advisory →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-33050
  2. 2026-11-06 Alias added: GHSA-9fpx-fr6j-2vh6
  3. 2026-11-06 Fix available: PyPI/[email protected] · GHSA-9fpx-fr6j-2vh6
  4. 2026-11-06 CVSS score added · GHSA-9fpx-fr6j-2vh6
  5. 2026-11-06 Weakness changed · GHSA-9fpx-fr6j-2vh6
  6. 2026-11-06 3 new references · GHSA-9fpx-fr6j-2vh6
  7. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2022-08629 Improper Control of Generation of Code in jai-ext KEVCVSS 3.1CRITICAL 10.0
  • TI-2023-22605 GeoNode SSRF Bypass to return internal host data CVSS 3.1HIGH 7.5
  • TI-2023-11277 XML External Entity (XXE) injection in GeoServer style upload functionality CVSS 3.1MEDIUM 6.5
  • TI-2023-20907 Geonode Server Side Request Forgery vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-12986 Geoserver for GeoNode sensitive information leak CVSS 3.1HIGH 7.5
  • TI-2026-86101 Stored XSS in GeoNode Documents metadata abstract field CVSS 3.1MEDIUM 6.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences