# geonode (PyPI) vulnerabilities 9 known vulnerabilities (3 high, 6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.1.1 (Oct 22, 2026): affected by CVE-2023-42439 - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 1,117 - Dependents: 0 - Releases: 239 since 2.0.0 (Apr 4, 2014) - Registry: https://pypi.org/project/geonode/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-55649: 2.0.0b3 to 5.0.2 (5.0.3 is outside it) - CVE-2026-46429: 2.0.0b3 to 5.0.2 (5.0.3 is outside it) - CVE-2026-33050: 2.0.0b3 to 5.0.3.post1 (5.1.0 is outside it) - CVE-2026-39922: 4.0.0 to 4.4.4 (4.4.5 is outside it); 5.0.0 to 5.0.1 (5.0.2 is outside it) - CVE-2026-39921: 4.0.0 to 4.4.4 (4.4.5 is outside it); 5.0.0 to 5.0.1 (5.0.2 is outside it) - CVE-2024-27091: 3.2.1 to 4.2.2 (4.2.3 is outside it) - CVE-2023-42439: 3.2.0 to 5.1.1 (through the newest release) - CVE-2023-40017: 3.2.0 to 4.1.5 (4.2.0 is outside it) - CVE-2023-26043: 2.0.0b3 to 4.0.2 (4.0.3 is outside it) ## Advisories (9) ### [CVE-2026-55649](https://cve.now/CVE-2026-55649): GeoNode has Stored XSS in Documents metadata abstract field - Severity: Medium 6.3 - Published: Nov 6, 2026 - Affected: fixed in 5.0.3. - Fixed in 5.0.3 (released Jun 29, 2026, 130 days before disclosure). - The latest release, 5.1.1, is not affected. ### [CVE-2026-46429](https://cve.now/CVE-2026-46429): GeoNode: Unrestricted File Upload - Severity: Medium 5.5 - Published: Nov 6, 2026 - Affected: fixed in 5.0.3. - Fixed in 5.0.3 (released Jun 29, 2026, 130 days before disclosure). - The latest release, 5.1.1, is not affected. ### [CVE-2026-33050](https://cve.now/CVE-2026-33050): GeoNode: OS command injection via uploaded file layer name - Severity: High 8.8 - Published: Nov 6, 2026 - Affected: fixed in 5.1.0. - Fixed in 5.1.0 (released Jun 29, 2026, 130 days before disclosure). - The latest release, 5.1.1, is not affected. ### [CVE-2026-39922](https://cve.now/CVE-2026-39922): GeoNode SSRF via Service Registration - Severity: Medium 5.3 - Published: Apr 10, 2026 - Affected: from 4.0.0, fixed in 4.4.5; from 5.0.0, fixed in 5.0.2; from 4.0.0, fixed in 4.4.5; from 5.0.0, fixed in 5.0.2. - Fixed in 4.4.5 (released Mar 20, 2026, 21 days before disclosure) and 5.0.2 (released Mar 31, 2026, 10 days before disclosure). - The latest release, 5.1.1, is not affected. ### [CVE-2026-39921](https://cve.now/CVE-2026-39921): GeoNode \< 4.4.5, 5.0.2 SSRF via Document Upload - Severity: Medium 5.3 - Published: Apr 10, 2026 - Affected: from 4.0.0, fixed in 4.4.5; from 5.0.0, fixed in 5.0.2. - Fixed in 4.4.5 (released Mar 20, 2026, 21 days before disclosure) and 5.0.2 (released Mar 31, 2026, 10 days before disclosure). - The latest release, 5.1.1, is not affected. ### [CVE-2024-27091](https://cve.now/CVE-2024-27091): GeoNode stored XSS to full account takeover - Severity: Medium 6.1 - Published: Mar 27, 2024 - Affected: from 3.2.1, fixed in 4.2.3. - Fixed in 4.2.3 (released Mar 27, 2024, the day of disclosure). - The latest release, 5.1.1, is not affected. ### [CVE-2023-42439](https://cve.now/CVE-2023-42439): GeoNode SSRF Bypass to return internal host data - Severity: High 7.5 - Published: Sep 15, 2023 - Affected: from 3.2.0, fixed in 4.1.3.post1; from 3.2.0. - No fix released. The latest release, 5.1.1, is still affected. ### [CVE-2023-40017](https://cve.now/CVE-2023-40017): Geonode Server Side Request Forgery vulnerability - Severity: High 7.5 - Published: Aug 24, 2023 - Affected: from 3.2.0, fixed in 4.1.3; from 3.2.0, fixed in 4.2.0. - Fixed in 4.2.0 (released Jan 10, 2024, 139 days after disclosure). - The latest release, 5.1.1, is not affected. ### [CVE-2023-26043](https://cve.now/CVE-2023-26043): XML External Entity (XXE) injection in GeoServer style upload functionality - Severity: Medium 6.5 - Published: Feb 27, 2023 - Affected: fixed in 4.0.3. - Fixed in 4.0.3 (released Feb 23, 2023, 4 days before disclosure). - The latest release, 5.1.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/geonode Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.