{"id":"CVE-2026-33050","kind":"vulnerability","aliases":["CVE-2026-33050","GHSA-9fpx-fr6j-2vh6"],"related":[],"title":"GeoNode has OS command injection via uploaded file layer name","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.","summary":"GeoNode fails to sanitize the layer name of an uploaded vector file, so a crafted name is passed to an operating system command. An attacker who can upload a file can run arbitrary commands on the GeoNode server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GeoNode","fixed":["5.1.0"],"affected":"< 5.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-78","geonode","gis","package","python","self-hosted"],"not_affected_if":["no-layer-uploads","version-5.1.0-or-later"],"how_to_check":"- Check the installed GeoNode version with `pip show GeoNode` or `pip show geonode`; affected if below `5.1.0`\n- Check whether the instance accepts vector file uploads for layers (unknown whether this is restricted by default)","fix":"- GeoNode: move to `5.1.0` or later","status":"open","published_at":"2026-11-06T19:39:38+00:00","first_seen_at":"2026-11-06T19:43:23+00:00","triaged_at":"2026-11-06T19:43:41+00:00","updated_at":"2026-11-06T20:43:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T19:43:41Z","model":"claude-haiku-5-5","output":{"fix":"- GeoNode: move to `5.1.0` or later","reach":"internet","title":"GeoNode: crafted uploaded layer name runs arbitrary OS commands","impact":"high","summary":"GeoNode fails to sanitize the layer name of an uploaded vector file, so a crafted name is passed to an operating system command. An attacker who can upload a file can run arbitrary commands on the GeoNode server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["geonode","python","self-hosted","gis"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the GeoNode server.","analyst_note":"","how_to_check":"- Check the installed GeoNode version with `pip show GeoNode` or `pip show geonode`; affected if below `5.1.0`\n- Check whether the instance accepts vector file uploads for layers (unknown whether this is restricted by default)","plain_action":"","needs_analyst":false,"not_affected_if":["version-5.1.0-or-later","no-layer-uploads"],"who_is_affected":"GeoNode instances older than 5.1.0 that let users upload vector files to create layers are exposed. The sources do not say whether uploads are restricted to authenticated users by default, so treat any instance that accepts uploads as in scope. Instances on 5.1.0 or later, or with no upload path, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4250,"output_tokens":538,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,20A '-33050':13A,21A '-78':24B '2vh6':18A '5.1.0':89C,127C '9fpx':16A 'allow':99C 'arbitrari':64B,112C 'attack':56B 'command':4A,54B,65B,116C 'content':74C 'craft':46B,91C 'cve':11A,19A 'cwe':23B 'data':86C 'execut':111C 'fail':33B 'file':8A,43B,61B,93C 'fix':124C 'fr6j':17A 'geonod':1A,25B,32B,68B,70C,119C 'geonode':22A 'geospati':73C,85C 'ghsa':15A 'ghsa-9fpx-fr6j-2vh6':14A 'gis':26B 'host':31B 'inject':5A,107C 'issu':122C 'layer':9A,37B,94C 'low':102C 'low-privileg':101C 'manag':75C,81C 'name':10A,38B,47B,95C 'oper':52B,114C 'operating-system':113C 'os':3A 'packag':27B 'pass':49B 'platform':78C 'prior':87C 'privileg':103C 'public':83C 'python':28B 'remot':104C 'run':63B 'sanit':35B 'self':30B 'self-host':29B 'server':69B,120C 'shell':108C 'suppli':96C 'syntax':109C 'system':53B,76C,115C 'upload':7A,41B,59B,98C 'user':105C 'vector':42B,92C 'version':126C 'via':6A","nicknames":[],"mitigations":[],"who_affected":"GeoNode instances older than 5.1.0 that let users upload vector files to create layers are exposed. The sources do not say whether uploads are restricted to authenticated users by default, so treat any instance that accepts uploads as in scope. Instances on 5.1.0 or later, or with no upload path, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["geonode"],"ptokens":["geonode"],"labels":["cwe78","geonode","gis","high","package","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,20A '-33050':13A,21A '2vh6':18A '9fpx':16A 'command':4A 'cve':11A,19A 'file':8A 'fr6j':17A 'geonod':1A 'geonode':22A 'ghsa':15A 'ghsa-9fpx-fr6j-2vh6':14A 'inject':5A 'layer':9A 'name':10A 'os':3A 'upload':7A 'via':6A","search_b":"'-78':24B 'arbitrari':64B 'attack':56B 'command':54B,65B 'craft':46B 'cwe':23B 'fail':33B 'file':43B,61B 'geonod':25B,32B,68B 'gis':26B 'host':31B 'layer':37B 'name':38B,47B 'oper':52B 'packag':27B 'pass':49B 'python':28B 'run':63B 'sanit':35B 'self':30B 'self-host':29B 'server':69B 'system':53B 'upload':41B,59B 'vector':42B","search_c":"'5.1.0':89C,127C 'allow':99C 'arbitrari':112C 'command':116C 'content':74C 'craft':91C 'data':86C 'execut':111C 'file':93C 'fix':124C 'geonod':70C,119C 'geospati':73C,85C 'inject':107C 'issu':122C 'layer':94C 'low':102C 'low-privileg':101C 'manag':75C,81C 'name':95C 'oper':114C 'operating-system':113C 'platform':78C 'prior':87C 'privileg':103C 'public':83C 'remot':104C 'server':120C 'shell':108C 'suppli':96C 'syntax':109C 'system':76C,115C 'upload':98C 'user':105C 'vector':92C 'version':126C","first_public_at":"2026-11-05T18:08:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9fpx-fr6j-2vh6","url":"https://github.com/advisories/GHSA-9fpx-fr6j-2vh6","severity":"high","published_at":"2026-11-06T19:39:38+00:00","modified_at":"2026-11-06T19:39:39+00:00","first_seen_at":"2026-11-06T19:43:23+00:00","fetched_at":"2026-11-06T19:50:51+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-33050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33050","severity":null,"published_at":"2026-11-06T20:17:22+00:00","modified_at":"2026-11-06T20:17:22+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:44:00+00:00","note":null}],"documents":[{"id":89221,"url":"https://api.github.com/repos/GeoNode/geonode/security-advisories/GHSA-9fpx-fr6j-2vh6","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":89222,"url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-9fpx-fr6j-2vh6","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-05T18:08:30+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":89223,"url":"https://github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89790,"url":"https://github.com/GeoNode/geonode/releases/tag/5.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}