GEONODE · CVE-2026-55649 · Package
FIX → 5.0.3
GeoNode does not sanitise the abstract metadata field of documents, so arbitrary HTML and JavaScript can be stored. The script runs in the browser of anyone who visits the document page.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any GeoNode deployment below 5.0.3 where users can edit document abstract metadata. Users who can only view documents, or who run a patched version, are not exposed. Exploitation requires someone to be able to write the abstract field, so the risk is highest on instances with wide editing rights.
Not affected if no-document-editing, patched-version
Who cares cwe-79, geonode, python, self-hosted
pip show geonode; versions below 5.0.3 are affected.pypi:GeoNode via your requirements or lock file.Upgrade to 5.0.3
5.0.3 or later.The abstract metadata of documents is not sanitised. It’s possible to store arbitrary HTML (and JS) that will be executed when visiting the page.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.