GeoNode versions prior to 5.1.0 are vulnerable to an OS command injection vulnerability via a crafted layer name in an uploaded vector file. This flaw allows an attacker with limited privileges to execute arbitrary operating system commands without user interaction. The vulnerability is addressed in GeoNode version 5.1.0.