{"id":"CVE-2026-111211","kind":"vulnerability","aliases":["CVE-2026-111211"],"related":[],"title":"Django: GIS geometry form field lets attackers forge log entries","description":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.","summary":"Django's GIS geometry form widget writes submitted invalid values to logs without escaping them. A remote attacker can send a crafted geometry value to inject or forge log lines.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["django","gis","package","python","web"],"not_affected_if":["no-gis-forms","older-unsupported-not-evaluated"],"how_to_check":"- Check the installed Django version with `python -m django --version`.\n- Look for `django.contrib.gis.forms.GeometryField` or `BaseGeometryWidget` in the project code.","fix":"- Django `6.1.3` for the 6.1 series\n- Django `6.0.10` for the 6.0 series\n- Django `5.2.19` for the 5.2 series\n- Earlier unsupported series were not evaluated by the sources; their status is unknown.","status":"open","published_at":"2026-11-03T16:17:18+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","triaged_at":"2026-11-03T16:24:03+00:00","updated_at":"2026-11-03T16:24:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:24:03Z","model":"claude-haiku-5-5","output":{"fix":"- Django `6.1.3` for the 6.1 series\n- Django `6.0.10` for the 6.0 series\n- Django `5.2.19` for the 5.2 series\n- Earlier unsupported series were not evaluated by the sources; their status is unknown.","reach":"internet","title":"Django: GIS geometry form field lets attackers forge log entries","impact":"low","summary":"Django's GIS geometry form widget writes submitted invalid values to logs without escaping them. A remote attacker can send a crafted geometry value to inject or forge log lines.","audience":"developers","category":"package","nicknames":[],"who_cares":["django","python","gis","web"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"forged or injected log entries pollute application logs","analyst_note":"","how_to_check":"- Check the installed Django version with `python -m django --version`.\n- Look for `django.contrib.gis.forms.GeometryField` or `BaseGeometryWidget` in the project code.","plain_action":"","needs_analyst":false,"not_affected_if":["no-gis-forms","older-unsupported-not-evaluated"],"who_is_affected":"Applications built on Django that use the django.contrib.gis forms (GeometryField or its widgets) and accept geometry input from users. Projects that do not use GIS form fields are not exposed through this path. Versions older than the listed series were not evaluated, so they may also be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4310,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111211':13A,16A '-2026':12A,15A '4.2':107C '5.0':104C '5.1':102C '5.2':65C '5.2.19':67C '6.0':61C '6.0.10':63C '6.1':58C '6.1.3':60C 'aaron':122C 'affect':116C 'allow':82C 'also':114C 'attack':7A,39B,84C 'chen':123C 'craft':43B,93C 'cve':11A,14A 'discov':55C 'django':1A,17B,22B,57C,98C,117C 'django.contrib.gis.forms.geometryfield':71C 'django.contrib.gis.forms.widgets.basegeometrywidget.deserialize':68C 'earlier':96C 'entri':10A,90C 'escap':35B,74C 'evalu':111C 'field':5A 'forg':8A,49B,88C 'form':4A,26B 'geometri':3A,25B,44B,94C 'gis':2A,18B,24B 'inject':47B,86C 'invalid':30B,75C 'issu':53C,127C 'let':6A 'like':119C 'line':51B 'log':9A,33B,50B,79C,89C 'may':113C 'packag':19B 'python':20B 'remot':38B,83C 'report':125C 'send':41B 'seri':99C 'submit':29B,76C 'thank':121C 'unsupport':97C 'use':69C 'valu':31B,45B,77C,95C 'via':91C 'web':21B 'widget':27B 'without':34B 'would':118C 'write':28B 'x':103C,105C,108C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Django that use the django.contrib.gis forms (GeometryField or its widgets) and accept geometry input from users. Projects that do not use GIS form fields are not exposed through this path. Versions older than the listed series were not evaluated, so they may also be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["django","gis","medium","package","python","web"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6a34fbeb-21d4-45e7-8e0a-62b95bc12c92","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111211","severity":null,"published_at":"2026-11-03T16:17:18+00:00","modified_at":"2026-11-03T16:17:18+00:00","first_seen_at":"2026-11-03T16:21:42+00:00","fetched_at":"2026-11-03T16:21:42+00:00","note":null}],"documents":[{"id":58781,"url":"https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58782,"url":"https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58783,"url":"https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58784,"url":"https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}