CVE-2026-55649mediumCWE-79

CVE-2026-55649: falha de média gravidade em geonode

GeoNode has Stored XSS in Documents metadata abstract field

Publicada em

Seguir esta CVE+ Monitorar geonode+ Monitorar geonode

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

10Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Produtos afetados
GeoNode · geonode
CVEs relacionadas — geonode

No mesmo produto, das mais perigosas para as menos.

CVE-2023-42439HIGHGeoNode SSRF Bypass to return internal host dataEPSS 1.0%CVE-2023-26043MEDIUMXML External Entity (XXE) injection in GeoServer style upload functionalityEPSS 0.8%CVE-2023-40017HIGHGeonode Server Side Request Forgery vulnerabilityEPSS 0.8%CVE-2023-28442HIGHGeoserver for GeoNode sensitive information leakEPSS 0.6%CVE-2024-27091MEDIUMGeoNode stored XSS to full account takeoverEPSS 0.4%CVE-2026-46429MEDIUMGeoNode: Unrestricted File UploadEPSS —