{"affected":[{"product":"geonode","source":"CNA: GitHub_M","vendor":"GeoNode","versions":[{"status":"affected","version":"< 5.1.0"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"geonode","product":"geonode","source":"OSV GHSA-9fpx-fr6j-2vh6","vendor":"","versions":[{"status":"affected","version":"2.0","versionType":"PyPI"},{"status":"affected","version":"2.0.1","versionType":"PyPI"},{"status":"affected","version":"2.0.dev20130913181950","versionType":"PyPI"},{"status":"affected","version":"2.0.dev20140626191247","versionType":"PyPI"},{"status":"affected","version":"2.0b10","versionType":"PyPI"},{"status":"affected","version":"2.0b11","versionType":"PyPI"},{"status":"affected","version":"2.0b12","versionType":"PyPI"},{"status":"affected","version":"2.0b13","versionType":"PyPI"},{"status":"affected","version":"2.0b17","versionType":"PyPI"},{"status":"affected","version":"2.0b18","versionType":"PyPI"},{"status":"affected","version":"2.0b19","versionType":"PyPI"},{"status":"affected","version":"2.0b21","versionType":"PyPI"},{"status":"affected","version":"2.0b22","versionType":"PyPI"},{"status":"affected","version":"2.0b24","versionType":"PyPI"},{"status":"affected","version":"2.0b25","versionType":"PyPI"},{"status":"affected","version":"2.0b26","versionType":"PyPI"},{"status":"affected","version":"2.0b27","versionType":"PyPI"},{"status":"affected","version":"2.0b28","versionType":"PyPI"},{"status":"affected","version":"2.0b29","versionType":"PyPI"},{"status":"affected","version":"2.0b3","versionType":"PyPI"},{"status":"affected","version":"2.0b30","versionType":"PyPI"},{"status":"affected","version":"2.0b31","versionType":"PyPI"},{"status":"affected","version":"2.0b32","versionType":"PyPI"},{"status":"affected","version":"2.0b33","versionType":"PyPI"},{"status":"affected","version":"2.0b34","versionType":"PyPI"},{"status":"affected","version":"2.0b35","versionType":"PyPI"},{"status":"affected","version":"2.0b36","versionType":"PyPI"},{"status":"affected","version":"2.0b37","versionType":"PyPI"},{"status":"affected","version":"2.0b38","versionType":"PyPI"},{"status":"affected","version":"2.0b39","versionType":"PyPI"},{"status":"affected","version":"2.0b4","versionType":"PyPI"},{"status":"affected","version":"2.0b40","versionType":"PyPI"},{"status":"affected","version":"2.0b41","versionType":"PyPI"},{"status":"affected","version":"2.0b42","versionType":"PyPI"},{"status":"affected","version":"2.0b43","versionType":"PyPI"},{"status":"affected","version":"2.0b44","versionType":"PyPI"},{"status":"affected","version":"2.0b45","versionType":"PyPI"},{"status":"affected","version":"2.0b46","versionType":"PyPI"},{"status":"affected","version":"2.0b48","versionType":"PyPI"},{"status":"affected","version":"2.0b49","versionType":"PyPI"},{"status":"affected","version":"2.0b5","versionType":"PyPI"},{"status":"affected","version":"2.0b50","versionType":"PyPI"},{"status":"affected","version":"2.0b51","versionType":"PyPI"},{"status":"affected","version":"2.0b52","versionType":"PyPI"},{"status":"affected","version":"2.0b53","versionType":"PyPI"},{"status":"affected","version":"2.0b54","versionType":"PyPI"},{"status":"affected","version":"2.0b55","versionType":"PyPI"},{"status":"affected","version":"2.0b57","versionType":"PyPI"},{"status":"affected","version":"2.0b58","versionType":"PyPI"},{"status":"affected","version":"2.0b59","versionType":"PyPI"},{"status":"affected","version":"2.0b60","versionType":"PyPI"},{"status":"affected","version":"2.0b61","versionType":"PyPI"},{"status":"affected","version":"2.0b62","versionType":"PyPI"},{"status":"affected","version":"2.0b63","versionType":"PyPI"},{"status":"affected","version":"2.0b64","versionType":"PyPI"},{"status":"affected","version":"2.0b7","versionType":"PyPI"},{"status":"affected","version":"2.0c1","versionType":"PyPI"},{"status":"affected","version":"2.0c12","versionType":"PyPI"},{"status":"affected","version":"2.0c13","versionType":"PyPI"},{"status":"affected","version":"2.0c2","versionType":"PyPI"},{"status":"affected","version":"2.0c3","versionType":"PyPI"},{"status":"affected","version":"2.0c4","versionType":"PyPI"},{"status":"affected","version":"2.0c5","versionType":"PyPI"},{"status":"affected","version":"2.0c7","versionType":"PyPI"},{"status":"affected","version":"2.0c8","versionType":"PyPI"},{"status":"affected","version":"2.10","versionType":"PyPI"},{"status":"affected","version":"2.10.1","versionType":"PyPI"},{"status":"affected","version":"2.10.2","versionType":"PyPI"},{"status":"affected","version":"2.10.3","versionType":"PyPI"},{"status":"affected","version":"2.10.4","versionType":"PyPI"},{"status":"affected","version":"2.10rc0","versionType":"PyPI"},{"status":"affected","version":"2.10rc1","versionType":"PyPI"},{"status":"affected","version":"2.10rc2","versionType":"PyPI"},{"status":"affected","version":"2.10rc3","versionType":"PyPI"},{"status":"affected","version":"2.10rc4","versionType":"PyPI"},{"status":"affected","version":"2.10rc5","versionType":"PyPI"},{"status":"affected","version":"2.4","versionType":"PyPI"},{"status":"affected","version":"2.4.1","versionType":"PyPI"},{"status":"affected","version":"2.4a1","versionType":"PyPI"},{"status":"affected","version":"2.4a10","versionType":"PyPI"},{"status":"affected","version":"2.4a11","versionType":"PyPI"},{"status":"affected","version":"2.4a12","versionType":"PyPI"},{"status":"affected","version":"2.4a13","versionType":"PyPI"},{"status":"affected","version":"2.4a14","versionType":"PyPI"},{"status":"affected","version":"2.4a15","versionType":"PyPI"},{"status":"affected","version":"2.4a16","versionType":"PyPI"},{"status":"affected","version":"2.4a17","versionType":"PyPI"},{"status":"affected","version":"2.4a18","versionType":"PyPI"},{"status":"affected","version":"2.4a19","versionType":"PyPI"},{"status":"affected","version":"2.4a2","versionType":"PyPI"},{"status":"affected","version":"2.4a20","versionType":"PyPI"},{"status":"affected","version":"2.4a21","versionType":"PyPI"},{"status":"affected","version":"2.4a22","versionType":"PyPI"},{"status":"affected","version":"2.4a23","versionType":"PyPI"},{"status":"affected","version":"2.4a24","versionType":"PyPI"},{"status":"affected","version":"2.4a25","versionType":"PyPI"},{"status":"affected","version":"2.4a26","versionType":"PyPI"},{"status":"affected","version":"2.4a28","versionType":"PyPI"},{"status":"affected","version":"2.4a29","versionType":"PyPI"},{"status":"affected","version":"2.4a3","versionType":"PyPI"},{"status":"affected","version":"2.4a30","versionType":"PyPI"},{"status":"affected","version":"2.4a31","versionType":"PyPI"},{"status":"affected","version":"2.4a32","versionType":"PyPI"},{"status":"affected","version":"2.4a33","versionType":"PyPI"},{"status":"affected","version":"2.4a34","versionType":"PyPI"},{"status":"affected","version":"2.4a35","versionType":"PyPI"},{"status":"affected","version":"2.4a36","versionType":"PyPI"},{"status":"affected","version":"2.4a38","versionType":"PyPI"},{"status":"affected","version":"2.4a4","versionType":"PyPI"},{"status":"affected","version":"2.4a5","versionType":"PyPI"},{"status":"affected","version":"2.4a6","versionType":"PyPI"},{"status":"affected","version":"2.4a7","versionType":"PyPI"},{"status":"affected","version":"2.4a8","versionType":"PyPI"},{"status":"affected","version":"2.4a9","versionType":"PyPI"},{"status":"affected","version":"2.4b1","versionType":"PyPI"},{"status":"affected","version":"2.4b10","versionType":"PyPI"},{"status":"affected","version":"2.4b11","versionType":"PyPI"},{"status":"affected","version":"2.4b12","versionType":"PyPI"},{"status":"affected","version":"2.4b13","versionType":"PyPI"},{"status":"affected","version":"2.4b14","versionType":"PyPI"},{"status":"affected","version":"2.4b15","versionType":"PyPI"},{"status":"affected","version":"2.4b16","versionType":"PyPI"},{"status":"affected","version":"2.4b17","versionType":"PyPI"},{"status":"affected","version":"2.4b18","versionType":"PyPI"},{"status":"affected","version":"2.4b19","versionType":"PyPI"},{"status":"affected","version":"2.4b2","versionType":"PyPI"},{"status":"affected","version":"2.4b20","versionType":"PyPI"},{"status":"affected","version":"2.4b21","versionType":"PyPI"},{"status":"affected","version":"2.4b22","versionType":"PyPI"},{"status":"affected","version":"2.4b23","versionType":"PyPI"},{"status":"affected","version":"2.4b24","versionType":"PyPI"},{"status":"affected","version":"2.4b25","versionType":"PyPI"},{"status":"affected","version":"2.4b26","versionType":"PyPI"},{"status":"affected","version":"2.4b27","versionType":"PyPI"},{"status":"affected","version":"2.4b28","versionType":"PyPI"},{"status":"affected","version":"2.4b3","versionType":"PyPI"},{"status":"affected","version":"2.4b4","versionType":"PyPI"},{"status":"affected","version":"2.4b5","versionType":"PyPI"},{"status":"affected","version":"2.4b6","versionType":"PyPI"},{"status":"affected","version":"2.4b7","versionType":"PyPI"},{"status":"affected","version":"2.4b8","versionType":"PyPI"},{"status":"affected","version":"2.4c1","versionType":"PyPI"},{"status":"affected","version":"2.4c2","versionType":"PyPI"},{"status":"affected","version":"2.4c3","versionType":"PyPI"},{"status":"affected","version":"2.4c4","versionType":"PyPI"},{"status":"affected","version":"2.5.1","versionType":"PyPI"},{"status":"affected","version":"2.5.10","versionType":"PyPI"},{"status":"affected","version":"2.5.12","versionType":"PyPI"},{"status":"affected","version":"2.5.13","versionType":"PyPI"},{"status":"affected","version":"2.5.14","versionType":"PyPI"},{"status":"affected","version":"2.5.15","versionType":"PyPI"},{"status":"affected","version":"2.5.2","versionType":"PyPI"},{"status":"affected","version":"2.5.3","versionType":"PyPI"},{"status":"affected","version":"2.5.4","versionType":"PyPI"},{"status":"affected","version":"2.5.5","versionType":"PyPI"},{"status":"affected","version":"2.5.6","versionType":"PyPI"},{"status":"affected","version":"2.5.7","versionType":"PyPI"},{"status":"affected","version":"2.5.9","versionType":"PyPI"},{"status":"affected","version":"2.5.9.dev20170116091328","versionType":"PyPI"},{"status":"affected","version":"2.5.dev20160825082804","versionType":"PyPI"},{"status":"affected","version":"2.6","versionType":"PyPI"},{"status":"affected","version":"2.6.1","versionType":"PyPI"},{"status":"affected","version":"2.6.2","versionType":"PyPI"},{"status":"affected","version":"2.6.3","versionType":"PyPI"},{"status":"affected","version":"2.6a1","versionType":"PyPI"},{"status":"affected","version":"2.6c1","versionType":"PyPI"},{"status":"affected","version":"2.7","versionType":"PyPI"},{"status":"affected","version":"2.7.1.dev20171013151516","versionType":"PyPI"},{"status":"affected","version":"2.7.2.dev20171013181854","versionType":"PyPI"},{"status":"affected","version":"2.7.4.dev20171114161428","versionType":"PyPI"},{"status":"affected","version":"2.7.5.dev20180123130714","versionType":"PyPI"},{"status":"affected","version":"2.7.5.dev20180125135927","versionType":"PyPI"},{"status":"affected","version":"2.8","versionType":"PyPI"},{"status":"affected","version":"2.8.1","versionType":"PyPI"},{"status":"affected","version":"2.8.1rc0","versionType":"PyPI"},{"status":"affected","version":"2.8rc0","versionType":"PyPI"},{"status":"affected","version":"2.8rc1","versionType":"PyPI"},{"status":"affected","version":"2.8rc10","versionType":"PyPI"},{"status":"affected","version":"2.8rc11","versionType":"PyPI"},{"status":"affected","version":"2.8rc12","versionType":"PyPI"},{"status":"affected","version":"2.8rc13","versionType":"PyPI"},{"status":"affected","version":"2.8rc2","versionType":"PyPI"},{"status":"affected","version":"2.8rc3","versionType":"PyPI"},{"status":"affected","version":"2.8rc4","versionType":"PyPI"},{"status":"affected","version":"2.8rc5","versionType":"PyPI"},{"status":"affected","version":"2.8rc6","versionType":"PyPI"},{"status":"affected","version":"2.8rc7","versionType":"PyPI"},{"status":"affected","version":"2.8rc8","versionType":"PyPI"},{"status":"affected","version":"2.8rc9","versionType":"PyPI"},{"status":"affected","version":"3.0.0","versionType":"PyPI"},{"status":"affected","version":"3.1.0","versionType":"PyPI"},{"status":"affected","version":"3.1.1","versionType":"PyPI"},{"status":"affected","version":"3.2.0","versionType":"PyPI"},{"status":"affected","version":"3.2.1","versionType":"PyPI"},{"status":"affected","version":"3.2.2","versionType":"PyPI"},{"status":"affected","version":"3.2.3","versionType":"PyPI"},{"status":"affected","version":"3.2.3.post1","versionType":"PyPI"},{"status":"affected","version":"3.2.4","versionType":"PyPI"},{"status":"affected","version":"3.3.0","versionType":"PyPI"},{"status":"affected","version":"3.3.1","versionType":"PyPI"},{"status":"affected","version":"3.3.1.post1","versionType":"PyPI"},{"status":"affected","version":"3.3.2","versionType":"PyPI"},{"status":"affected","version":"3.3.2.post1","versionType":"PyPI"},{"status":"affected","version":"3.3.2.post2","versionType":"PyPI"},{"status":"affected","version":"3.3.3","versionType":"PyPI"},{"status":"affected","version":"4.0.0","versionType":"PyPI"},{"status":"affected","version":"4.0.0.post1","versionType":"PyPI"},{"status":"affected","version":"4.0.0rc0","versionType":"PyPI"},{"status":"affected","version":"4.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"4.0.1","versionType":"PyPI"},{"status":"affected","version":"4.0.2","versionType":"PyPI"},{"status":"affected","version":"4.0.3","versionType":"PyPI"},{"status":"affected","version":"4.1.0","versionType":"PyPI"},{"status":"affected","version":"4.1.1","versionType":"PyPI"},{"status":"affected","version":"4.1.2","versionType":"PyPI"},{"status":"affected","version":"4.1.3","versionType":"PyPI"},{"status":"affected","version":"4.1.3.post1","versionType":"PyPI"},{"status":"affected","version":"4.1.4","versionType":"PyPI"},{"status":"affected","version":"4.1.5","versionType":"PyPI"},{"status":"affected","version":"4.2.0","versionType":"PyPI"},{"status":"affected","version":"4.2.1","versionType":"PyPI"},{"status":"affected","version":"4.2.2","versionType":"PyPI"},{"status":"affected","version":"4.2.3","versionType":"PyPI"},{"status":"affected","version":"4.2.4","versionType":"PyPI"},{"status":"affected","version":"4.2.5","versionType":"PyPI"},{"status":"affected","version":"4.3.0","versionType":"PyPI"},{"status":"affected","version":"4.3.0.post1","versionType":"PyPI"},{"status":"affected","version":"4.3.1","versionType":"PyPI"},{"status":"affected","version":"4.4.0","versionType":"PyPI"},{"status":"affected","version":"4.4.1","versionType":"PyPI"},{"status":"affected","version":"4.4.2","versionType":"PyPI"},{"status":"affected","version":"4.4.3","versionType":"PyPI"},{"status":"affected","version":"4.4.4","versionType":"PyPI"},{"status":"affected","version":"4.4.5","versionType":"PyPI"},{"status":"affected","version":"5.0.0","versionType":"PyPI"},{"status":"affected","version":"5.0.1","versionType":"PyPI"},{"status":"affected","version":"5.0.2","versionType":"PyPI"},{"status":"affected","version":"5.0.3","versionType":"PyPI"},{"status":"affected","version":"5.0.3.post1","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"5.1.0"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-33050","cwes":["CWE-78"],"description":"GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":8.8,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794001243450,"publishedAt":1793993953680,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-9fpx-fr6j-2vh6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/GeoNode/geonode/releases/tag/5.1.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/GeoNode/geonode/releases/tag/5.1.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-9fpx-fr6j-2vh6"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-9fpx-fr6j-2vh6"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-9fpx-fr6j-2vh6"}],"remediation":[{"kind":"fix","source":"OSV GHSA-9fpx-fr6j-2vh6","text":"geonode (PyPI): OSV reports a fixed version 5.1.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-9fpx-fr6j-2vh6"}],"revision":"5fa08ebd33153f5c7d4b89e3e8abaf41495e877805f8c3540588ddc9b740e3a1","sources":[{"modifiedAt":1793993953680,"name":"CNA: GitHub_M","retrievedAt":1793995861129,"url":"https://www.cve.org/CVERecord?id=CVE-2026-33050"},{"modifiedAt":1794001243450,"name":"NVD","retrievedAt":1794011244109,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33050"},{"modifiedAt":1793994305134,"name":"OSV / GitHub Security Advisories","retrievedAt":1793995861879,"url":"https://osv.dev/vulnerability/GHSA-9fpx-fr6j-2vh6"}],"ssvc":null,"status":"published","title":"GeoNode: OS command injection via uploaded file layer name","updatedAt":1794011244109}