---
id: "CVE-2026-55649"
page: "https://infrastack.ai/live/CVE-2026-55649"
kind: "vulnerability"
aliases: ["CVE-2026-55649", "GHSA-r4hm-p9f9-fj9v"]
title: "GeoNode has Stored XSS in Documents metadata abstract field"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "GeoNode", "fixed": ["5.0.3"], "affected": "< 5.0.3", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["cwe-79", "geonode", "package", "python", "self-hosted"]
not_affected_if: ["no-document-editing", "patched-version"]
published_at: "2026-11-06T19:50:34+00:00"
first_seen_at: "2026-11-06T19:53:29+00:00"
updated_at: "2026-11-06T20:44:00+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-r4hm-p9f9-fj9v", "first_seen_at": "2026-11-06T19:53:29+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55649", "first_seen_at": "2026-11-06T20:44:00+00:00"}]
exploit_sources: []
---

# GeoNode has Stored XSS in Documents metadata abstract field

Link for people: https://infrastack.ai/live/CVE-2026-55649 (this .md is for agents)

GeoNode does not sanitise the abstract metadata field of documents, so arbitrary HTML and JavaScript can be stored. The script runs in the browser of anyone who visits the document page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:GeoNode affected < 5.0.3 fixed 5.0.3

## How to check

- Check the installed GeoNode version with `pip show geonode`; versions below `5.0.3` are affected.
- Confirm the GeoNode install is in `pypi:GeoNode` via your requirements or lock file.

## Fix

- Upgrade GeoNode to `5.0.3` or later.

## Timeline

- 2026-11-06T19:53:29+00:00 ghsa https://github.com/advisories/GHSA-r4hm-p9f9-fj9v
- 2026-11-06T20:44:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55649

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/GeoNode/geonode/security-advisories/GHSA-r4hm-p9f9-fj9v
- [advisory] Maintainer's advisory: github.com https://github.com/GeoNode/geonode/security/advisories/GHSA-r4hm-p9f9-fj9v
- [fix] Patch: github.com https://github.com/GeoNode/geonode/pull/14322
- [fix] Patch: github.com https://github.com/GeoNode/geonode/pull/14343
- [fix] Patch: github.com https://github.com/GeoNode/geonode/commit/0803857b22eba5b55729145ef401b1bc1c23e332
- [fix] Patch: github.com https://github.com/GeoNode/geonode/commit/730d8fae206ea5b051f630718aeecae1bf7b5760
- [fix] Release: github.com https://github.com/GeoNode/geonode/releases/tag/5.0.3

## From the sources

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_