Live › vulnerability › CVE-2026-111211
Django's GIS geometry form widget writes submitted invalid values to logs without escaping them. A remote attacker can send a crafted geometry value to inject or forge log lines.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Applications built on Django that use the django.contrib.gis forms (GeometryField or its widgets) and accept geometry input from users. Projects that do not use GIS form fields are not exposed through this path. Versions older than the listed series were not evaluated, so they may also be affected.
No product ranges from the sources yet.
python -m django --version.django.contrib.gis.forms.GeometryField or BaseGeometryWidget in the project code.6.1.3 for the 6.1 series6.0.10 for the 6.0 series5.2.19Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111211")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.