Live › vulnerability › CVE-2026-111362
Django's GIS OGRGeometry class accepts external coordinate reference system definitions in GeoJSON input without restriction. A remote attacker can send crafted crs members to make the server issue requests to destinations of their choosing (server-side request forgery).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Applications built on Django that use the GIS contrib module (django.contrib.gis) and accept GeoJSON from outside, for example through an API or form, are exposed. Projects that do not use GIS features or never parse untrusted GeoJSON can skip it. The sources do not say whether the unsupported 5.1, 5.0 and 4.2 series are affected, only that they were not evaluated.
No product ranges from the sources yet.
python -m django --version, and look for django.contrib.gis in INSTALLED_APPSOGRGeometry6.1.3 or later6.0.105.2.19 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected destinations via crafted crs members.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Submersion Security Research Team for reporting this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-111362")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.