PyPIPackage

geonode

9 known vulnerabilities (3 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release: 5.1.1 (Oct 22, 2026): affected by CVE-2023-42439
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 9 · 3 high, 6 medium

Weekly downloads: 1,117
Dependents: 0
Releases: 239 since 2.0.0 (Apr 4, 2014)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-55649
Affects 2.0.0b3 to 5.0.2 (5.0.3 is outside it)
CVE-2026-46429
Affects 2.0.0b3 to 5.0.2 (5.0.3 is outside it)
CVE-2026-33050
Affects 2.0.0b3 to 5.0.3.post1 (5.1.0 is outside it)
CVE-2026-39922
Affects 4.0.0 to 4.4.4 (4.4.5 is outside it); 5.0.0 to 5.0.1 (5.0.2 is outside it)
CVE-2026-39921
Affects 4.0.0 to 4.4.4 (4.4.5 is outside it); 5.0.0 to 5.0.1 (5.0.2 is outside it)
CVE-2024-27091
Affects 3.2.1 to 4.2.2 (4.2.3 is outside it)
CVE-2023-42439
Affects 3.2.0 to 5.1.1 (through the newest release)
CVE-2023-40017
Affects 3.2.0 to 4.1.5 (4.2.0 is outside it)
CVE-2023-26043
Affects 2.0.0b3 to 4.0.2 (4.0.3 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-55649Medium 6.3
GeoNode has Stored XSS in Documents metadata abstract field
Affected: fixed in 5.0.3.
Fixed in 5.0.3 (released Jun 29, 2026, 130 days before disclosure).
The latest release, 5.1.1, is not affected.
CVE-2026-46429Medium 5.5
GeoNode: Unrestricted File Upload
Affected: fixed in 5.0.3.
Fixed in 5.0.3 (released Jun 29, 2026, 130 days before disclosure).
The latest release, 5.1.1, is not affected.
CVE-2026-33050High 8.8
GeoNode: OS command injection via uploaded file layer name
Affected: fixed in 5.1.0.
Fixed in 5.1.0 (released Jun 29, 2026, 130 days before disclosure).
The latest release, 5.1.1, is not affected.
CVE-2026-39922Medium 5.3
GeoNode SSRF via Service Registration
Affected: from 4.0.0, fixed in 4.4.5; from 5.0.0, fixed in 5.0.2; from 4.0.0, fixed in 4.4.5; from 5.0.0, fixed in 5.0.2.
Fixed in 4.4.5 (released Mar 20, 2026, 21 days before disclosure) and 5.0.2 (released Mar 31, 2026, 10 days before disclosure).
The latest release, 5.1.1, is not affected.
CVE-2026-39921Medium 5.3
GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload
Affected: from 4.0.0, fixed in 4.4.5; from 5.0.0, fixed in 5.0.2.
Fixed in 4.4.5 (released Mar 20, 2026, 21 days before disclosure) and 5.0.2 (released Mar 31, 2026, 10 days before disclosure).
The latest release, 5.1.1, is not affected.
CVE-2024-27091Medium 6.1
GeoNode stored XSS to full account takeover
Affected: from 3.2.1, fixed in 4.2.3.
Fixed in 4.2.3 (released Mar 27, 2024, the day of disclosure).
The latest release, 5.1.1, is not affected.
CVE-2023-42439High 7.5
GeoNode SSRF Bypass to return internal host data
Affected: from 3.2.0, fixed in 4.1.3.post1; from 3.2.0.
No fix released. The latest release, 5.1.1, is still affected.
CVE-2023-40017High 7.5
Geonode Server Side Request Forgery vulnerability
Affected: from 3.2.0, fixed in 4.1.3; from 3.2.0, fixed in 4.2.0.
Fixed in 4.2.0 (released Jan 10, 2024, 139 days after disclosure).
The latest release, 5.1.1, is not affected.
CVE-2023-26043Medium 6.5
XML External Entity (XXE) injection in GeoServer style upload functionality
Affected: fixed in 4.0.3.
Fixed in 4.0.3 (released Feb 23, 2023, 4 days before disclosure).
The latest release, 5.1.1, is not affected.