GEONODE · CVE-2026-33050 · Package
FIX → 5.1.0
GeoNode fails to sanitize the layer name of an uploaded vector file, so a crafted name is passed to an operating system command. An attacker who can upload a file can run arbitrary commands on the GeoNode server.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
GeoNode instances older than 5.1.0 that let users upload vector files to create layers are exposed. The sources do not say whether uploads are restricted to authenticated users by default, so treat any instance that accepts uploads as in scope. Instances on 5.1.0 or later, or with no upload path, are not affected.
Not affected if no-layer-uploads, version-5.1.0-or-later
Who cares cwe-78, geonode, gis, python, self-hosted
pip show GeoNode or pip show geonode; affected if below 5.1.0Upgrade to 5.1.0
5.1.0 or laterArbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.