DailyCVE@dailycve
🟠 GeoNode, Stored Cross-Site Scripting, #CVE-2026-55649 (Moderate) -DC-Nov2026-4242 https://dailycve.com/geonode-stored-cross-site-scripting-cve-2026-55649-moderate-dc-nov2026-4242/
0000031
253 followersView on X
CVE-2026-55649
LOWCVSS 6.3 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.
0.0/ 10 priority
Sources & remediation
Other references
- https://github.com/GeoNode/geonode/commit/0803857b22eba5b55729145ef401b1bc1c23e332
- https://github.com/GeoNode/geonode/commit/730d8fae206ea5b051f630718aeecae1bf7b5760
- https://github.com/GeoNode/geonode/pull/14322
- https://github.com/GeoNode/geonode/pull/14343
- https://github.com/GeoNode/geonode/releases/tag/5.0.3
Weakness type (CWE)
CWE-79
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day