Threats affecting pkg:pypi/GeoNode

GeoNode versions prior to 5.0.3 contain a stored cross-site scripting (XSS) vulnerability in the documents metadata abstract field. This field does not sanitize input, allowing attackers to store arbitrary HTML and JavaScript that executes when the page is viewed. The vulnerability has a CVSS score of 6.3 (medium severity) and is fixed in version 5.0.3.

GeoNode versions prior to 5.0.3 contain an unrestricted file upload vulnerability that allows attackers to bypass upload validation using specially crafted requests. This flaw enables the storage and serving of malicious files, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability is tracked as CVE-2026-46429 and has a medium severity rating with a CVSS score of 5.5. A fix is available in GeoNode version 5.0.3.

GeoNode versions prior to 5.1.0 are vulnerable to an OS command injection vulnerability via a crafted layer name in an uploaded vector file. This flaw allows an attacker with limited privileges to execute arbitrary operating system commands without user interaction. The vulnerability is addressed in GeoNode version 5.1.0.

GeoNode versions 3.2.1 up to but not including 4.2.3 contain a stored cross-site scripting (XSS) vulnerability in the rich text editor. This vulnerability allows an attacker to retrieve a victim's CSRF token and perform actions such as changing the victim's email address, potentially leading to full account takeover. The vulnerability bypasses CORS policy restrictions due to the script element's behavior. The issue is classified as CWE-79 and has a moderate severity rating.

GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.