GHSA-r4hm-p9f9-fj9v: GeoNode has Stored XSS in Documents metadata abstract field

Q: What access does an attacker need to exploit this issue?

An attacker needs the ability to set or modify the abstract metadata of a document. They can store arbitrary HTML and JavaScript in that field.

Q: Who is exposed to the stored payload?

Users who visit the affected document page are exposed because the stored HTML and JavaScript execute when that page is visited.

Q: How can I check whether my GeoNode instance has been affected?

Review document abstract metadata for unexpected HTML or JavaScript content, particularly script-capable markup. Also inspect document pages for rendered or executing untrusted content in the abstract field.

Published Nov 6, 2026

Updated

The abstract metadata of documents is not sanitised. It’s possible to store arbitrary HTML (and JS) that will be executed when visiting the page.

Affected Software

2 affected componentsFixes available

pip/geonode<5.0.3

5.0.3

pip/geonode<5.0.3

5.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/GeoNode to a version that resolves this vulnerability.
Fixed in 5.0.3
Upgrade
Upgrade pip/geonode to a version that resolves this vulnerability.
Fixed in 5.0.3

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs the ability to set or modify the abstract metadata of a document. They can store arbitrary HTML and JavaScript in that field.

Who is exposed to the stored payload?

Users who visit the affected document page are exposed because the stored HTML and JavaScript execute when that page is visited.

How can I check whether my GeoNode instance has been affected?

Review document abstract metadata for unexpected HTML or JavaScript content, particularly script-capable markup. Also inspect document pages for rendered or executing untrusted content in the abstract field.

GHSA-r4hm-p9f9-fj9v: GeoNode has Stored XSS in Documents metadata abstract field

Affected Software

Remediation

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Who is exposed to the stored payload?

How can I check whether my GeoNode instance has been affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Who is exposed to the stored payload?

How can I check whether my GeoNode instance has been affected?