{"id":"CVE-2026-55649","kind":"vulnerability","aliases":["CVE-2026-55649","GHSA-r4hm-p9f9-fj9v"],"related":[],"title":"GeoNode has Stored XSS in Documents metadata abstract field","description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.","summary":"GeoNode does not sanitise the abstract metadata field of documents, so arbitrary HTML and JavaScript can be stored. The script runs in the browser of anyone who visits the document page.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GeoNode","fixed":["5.0.3"],"affected":"< 5.0.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-79","geonode","package","python","self-hosted"],"not_affected_if":["no-document-editing","patched-version"],"how_to_check":"- Check the installed GeoNode version with `pip show geonode`; versions below `5.0.3` are affected.\n- Confirm the GeoNode install is in `pypi:GeoNode` via your requirements or lock file.","fix":"- Upgrade GeoNode to `5.0.3` or later.","status":"open","published_at":"2026-11-06T19:50:34+00:00","first_seen_at":"2026-11-06T19:53:29+00:00","triaged_at":"2026-11-06T19:53:56+00:00","updated_at":"2026-11-06T20:44:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T19:53:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GeoNode to `5.0.3` or later.","reach":"internet","title":"GeoNode: stored XSS through document abstract metadata field","impact":"medium","summary":"GeoNode does not sanitise the abstract metadata field of documents, so arbitrary HTML and JavaScript can be stored. The script runs in the browser of anyone who visits the document page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["geonode","python","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs in victims' browsers on the GeoNode site","analyst_note":"","how_to_check":"- Check the installed GeoNode version with `pip show geonode`; versions below `5.0.3` are affected.\n- Confirm the GeoNode install is in `pypi:GeoNode` via your requirements or lock file.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-document-editing"],"who_is_affected":"Any GeoNode deployment below 5.0.3 where users can edit document abstract metadata. Users who can only view documents, or who run a patched version, are not exposed. Exploitation requires someone to be able to write the abstract field, so the risk is highest on instances with wide editing rights.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4316,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A '-55649':12A,20A '-79':23B '5.0.3':80C,120C 'abstract':8A,35B,82C 'allow':88C 'anoth':104C 'anyon':55B 'arbitrari':41B,97C 'browser':53B,107C 'content':65C 'cve':10A,18A 'cwe':22B 'data':77C 'document':6A,39B,59B,81C,110C 'execut':102C 'field':9A,37B 'fix':117C 'fj9v':17A 'geonod':1A,24B,30B,61C 'geonode':21A 'geospati':64C,76C 'ghsa':14A 'ghsa-r4hm-p9f9-fj9v':13A 'host':29B 'html':42B,98C 'issu':115C 'javascript':44B,100C 'low':91C 'low-privileg':90C 'manag':66C,72C 'metadata':7A,36B,83C 'p9f9':16A 'packag':25B 'page':60B,111C 'persist':96C 'platform':69C 'prior':78C 'privileg':92C 'public':74C 'python':26B 'r4hm':15A 'remot':93C 'run':50B 'sanit':87C 'sanitis':33B 'script':49B 'self':28B 'self-host':27B 'store':3A,47B,85C 'system':67C 'user':94C,105C 'version':119C 'visit':57B,113C 'without':86C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Any GeoNode deployment below 5.0.3 where users can edit document abstract metadata. Users who can only view documents, or who run a patched version, are not exposed. Exploitation requires someone to be able to write the abstract field, so the risk is highest on instances with wide editing rights.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["geonode"],"ptokens":["geonode"],"labels":["cwe79","geonode","medium","package","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,19A '-55649':12A,20A 'abstract':8A 'cve':10A,18A 'document':6A 'field':9A 'fj9v':17A 'geonod':1A 'geonode':21A 'ghsa':14A 'ghsa-r4hm-p9f9-fj9v':13A 'metadata':7A 'p9f9':16A 'r4hm':15A 'store':3A 'xss':4A","search_b":"'-79':23B 'abstract':35B 'anyon':55B 'arbitrari':41B 'browser':53B 'cwe':22B 'document':39B,59B 'field':37B 'geonod':24B,30B 'host':29B 'html':42B 'javascript':44B 'metadata':36B 'packag':25B 'page':60B 'python':26B 'run':50B 'sanitis':33B 'script':49B 'self':28B 'self-host':27B 'store':47B 'visit':57B","search_c":"'5.0.3':80C,120C 'abstract':82C 'allow':88C 'anoth':104C 'arbitrari':97C 'browser':107C 'content':65C 'data':77C 'document':81C,110C 'execut':102C 'fix':117C 'geonod':61C 'geospati':64C,76C 'html':98C 'issu':115C 'javascript':100C 'low':91C 'low-privileg':90C 'manag':66C,72C 'metadata':83C 'page':111C 'persist':96C 'platform':69C 'prior':78C 'privileg':92C 'public':74C 'remot':93C 'sanit':87C 'store':85C 'system':67C 'user':94C,105C 'version':119C 'visit':113C 'without':86C","first_public_at":"2026-11-05T18:06:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-r4hm-p9f9-fj9v","url":"https://github.com/advisories/GHSA-r4hm-p9f9-fj9v","severity":"medium","published_at":"2026-11-06T19:50:34+00:00","modified_at":"2026-11-06T19:50:35+00:00","first_seen_at":"2026-11-06T19:53:29+00:00","fetched_at":"2026-11-06T20:00:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-55649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55649","severity":null,"published_at":"2026-11-06T20:17:23+00:00","modified_at":"2026-11-06T20:17:23+00:00","first_seen_at":"2026-11-06T20:44:00+00:00","fetched_at":"2026-11-06T20:44:00+00:00","note":null}],"documents":[{"id":89421,"url":"https://api.github.com/repos/GeoNode/geonode/security-advisories/GHSA-r4hm-p9f9-fj9v","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":89422,"url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-r4hm-p9f9-fj9v","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-11-05T18:06:25+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":89423,"url":"https://github.com/GeoNode/geonode/pull/14322","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89424,"url":"https://github.com/GeoNode/geonode/pull/14343","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89425,"url":"https://github.com/GeoNode/geonode/commit/0803857b22eba5b55729145ef401b1bc1c23e332","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89426,"url":"https://github.com/GeoNode/geonode/commit/730d8fae206ea5b051f630718aeecae1bf7b5760","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89220,"url":"https://github.com/GeoNode/geonode/releases/tag/5.0.3","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}