CVE-2025-69662Disclosure(geopandas / geopandas)

LOWCVSS 8.6 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch geopandas geopandas systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

geopandas CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/geopandas/geopandas/pull/3681

Exploit / PoC references

https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas/

Other references

https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

geopandas

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
8 mentions across 5 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 8 signals
Disclosure: 7 classified signals
General: 1 classified signal
Peaked 4d ago at 3 mentions (2026-01-30); latest day: 1
8 total mentions across 5 days

Affected systems

Vendors

geopandas

Products

geopandas

Deep dive

Activity timeline8 mentions / 5d

Signal classification2 categories

Disclosure

787.5%

General

112.5%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-30	3	Disclosure2General1
2026-01-31	1	Disclosure1
2026-02-01	2	Disclosure2
2026-02-03	1	Disclosure1
2026-03-11	1	Disclosure1

Full discourse8 posts

Yunus Aydın@aydinnyunuss250d
Disclosure
🚨 CVE-2025-69662 | SQL Injection in GeoPandas While using GeoPandas, I found a SQL Injection vulnerability in to_postgis() caused by direct string concatenation of user input. This library is downloaded ~2M times per week. https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas/ #security #cve #bugbounty
Post summary
The tweet announces a newly discovered SQL Injection vulnerability in GeoPandas’s to_postgis() function, providing a link to a post that likely contains proof of concept details.
0102491.1K
916 followersView on X
Ferramentas Linux@Cezar_H_Linux212d
Disclosure
🔴 URGENT: Your #Ubuntu Geospatial Data May Be at Risk 🔴 A newly disclosed SQL injection vulnerability (CVE-2025-69662) in GeoPandas affects millions of Ubuntu users, including those on LTS versions 22.04 and 24.04. Read more: 👉 https://tinyurl.com/4xu2v3rk #Security https://t.co/bfPt8pXN7R
Post summary
The tweet announces a newly disclosed SQL injection vulnerability, CVE-2025-69662, affecting GeoPandas on Ubuntu LTS releases 22.04 and 24.04, with no mention of PoC, exploitation, or patch.
00000103
1.3K followersView on X
PulsePatch.io@pulsepatchio248d
Disclosure
geopandas is affected by a SQL injection vulnerability (UBUNTU-CVE-2025-69662) in to_postgis(). Attackers could obtain sensitive data. Review usage of user-controlled input. #geopandas #SQLi #infosec https://www.pulsepatch.io/posts/geopandas-sql-injection-ubuntucve-2025-69662
Post summary
The post announces a SQL injection flaw (UBUNTU-CVE-2025-69662) in geopandas's to_postgis() function that could allow attackers to extract sensitive data, but it does not mention an exploit, PoC, patch, or active exploitation.
0000048
1 followersView on X
PulsePatch.io@pulsepatchio250d
Disclosure
Geopandas is affected by a SQL injection vulnerability (CVE-2025-69662) in the to_postgis() function. This could allow sensitive data retrieval. #Geopandas #SQLi #infosec https://www.pulsepatch.io/posts/cve-2025-69662-geopandas-sql-injection
Post summary
Geopandas is affected by a SQL injection flaw (CVE-2025-69662) in its to_postgis() function, potentially allowing sensitive data retrieval.
0000059
1 followersView on X
PulsePatch.io@pulsepatchio251d
Disclosure
Python GeoPandas users should note a SQL injection flaw (CVE-2025-69662) in to_postgis(). Ensure untrusted input is sanitized before writing GeoDataFrames. #Python #GeoPandas #SQLi https://www.pulsepatch.io/posts/cve-2025-69662-python-geopandas-sql-injection
Post summary
The article announces a SQL injection vulnerability (CVE-2025-69662) in GeoPandas' to_postgis() method and advises users to sanitize untrusted input to mitigate the risk.
0000068
1 followersView on X
The Hacker Wire@TheHackerWire252d
General
🟠 CVE-2025-69662 - High SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL dat... https://www.thehackerwire.com/vulnerability/CVE-2025-69662/ https://t.co/1PloICoyCL
Post summary
The tweet announces a high‑severity SQL injection in geopandas pre‑v1.1.2 that could leak sensitive data via to_postgis(), linking to a vulnerability article but offering no proof of exploitation or mitigation.
0000048
113 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds252d
Disclosure
CVE-2025-69662 SQL Injection in GeoPandas Before v1.1.2 Enabling Sensitive Information Disclosure https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-69662
Post summary
The text announces CVE-2025-69662, a SQL injection flaw in GeoPandas versions earlier than 1.1.2 that could expose sensitive data, with no mention of exploits, patches, or current attacks.
0000058
4.0K followersView on X
CVE@CVEnew252d
Disclosure
CVE-2025-69662 SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataF… https://www.cve.org/CVERecord?id=CVE-2025-69662
Post summary
The text announces a new SQL injection vulnerability in geopandas (v < 1.1.2) affecting the to_postgis() function, potentially exposing sensitive data.
00000229
56.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	geopandas	geopandas	-	python	-

Explore more

Back to dashboard geopandas CVEs geopandas vulnerabilities

What researchers are saying

CVE-2025-69662

Yunus Aydın@aydinnyunussDisclosure

The tweet announces a newly discovered SQL Injection vulnerability in GeoPandas’s to_postgis() function, providing a link to a post that likely contains proof of concept details.

Ferramentas Linux@Cezar_H_LinuxDisclosure

The tweet announces a newly disclosed SQL injection vulnerability, CVE-2025-69662, affecting GeoPandas on Ubuntu LTS releases 22.04 and 24.04, with no mention of PoC, exploitation, or patch.

PulsePatch.io@pulsepatchioDisclosure

The post announces a SQL injection flaw (UBUNTU-CVE-2025-69662) in geopandas's to_postgis() function that could allow attackers to extract sensitive data, but it does not mention an exploit, PoC, patch, or active exploitation.

PulsePatch.io@pulsepatchioDisclosure

Geopandas is affected by a SQL injection flaw (CVE-2025-69662) in its to_postgis() function, potentially allowing sensitive data retrieval.

PulsePatch.io@pulsepatchioDisclosure

The article announces a SQL injection vulnerability (CVE-2025-69662) in GeoPandas' to_postgis() method and advises users to sanitize untrusted input to mitigate the risk.

The Hacker Wire@TheHackerWireGeneral

The tweet announces a high‑severity SQL injection in geopandas pre‑v1.1.2 that could leak sensitive data via to_postgis(), linking to a vulnerability article but offering no proof of exploitation or mitigation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces CVE-2025-69662, a SQL injection flaw in GeoPandas versions earlier than 1.1.2 that could expose sensitive data, with no mention of exploits, patches, or current attacks.

CVE@CVEnewDisclosure

The text announces a new SQL injection vulnerability in geopandas (v < 1.1.2) affecting the to_postgis() function, potentially exposing sensitive data.