# CVE-2026-55649: GeoNode has Stored XSS in Documents metadata abstract field

Status: published. Published: 2026-11-06. Updated: 2026-11-06.

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.

## Remediation

- fix: geonode (PyPI): OSV reports a fixed version 5.0.3. Check the advisory for supported release branches. (source: OSV GHSA-r4hm-p9f9-fj9v) — https://github.com/advisories/GHSA-r4hm-p9f9-fj9v

## Affected products and versions

- GeoNode / geonode: < 5.0.3 (affected). Source: CNA: GitHub_M
-  / geonode (geonode): 2.0 (affected, PyPI); 2.0.1 (affected, PyPI); 2.0.dev20130913181950 (affected, PyPI); 2.0.dev20140626191247 (affected, PyPI); 2.0b10 (affected, PyPI); 2.0b11 (affected, PyPI); 2.0b12 (affected, PyPI); 2.0b13 (affected, PyPI); 2.0b17 (affected, PyPI); 2.0b18 (affected, PyPI); 2.0b19 (affected, PyPI); 2.0b21 (affected, PyPI); 2.0b22 (affected, PyPI); 2.0b24 (affected, PyPI); 2.0b25 (affected, PyPI); 2.0b26 (affected, PyPI); 2.0b27 (affected, PyPI); 2.0b28 (affected, PyPI); 2.0b29 (affected, PyPI); 2.0b3 (affected, PyPI); 2.0b30 (affected, PyPI); 2.0b31 (affected, PyPI); 2.0b32 (affected, PyPI); 2.0b33 (affected, PyPI); 2.0b34 (affected, PyPI); 2.0b35 (affected, PyPI); 2.0b36 (affected, PyPI); 2.0b37 (affected, PyPI); 2.0b38 (affected, PyPI); 2.0b39 (affected, PyPI); 2.0b4 (affected, PyPI); 2.0b40 (affected, PyPI); 2.0b41 (affected, PyPI); 2.0b42 (affected, PyPI); 2.0b43 (affected, PyPI); 2.0b44 (affected, PyPI); 2.0b45 (affected, PyPI); 2.0b46 (affected, PyPI); 2.0b48 (affected, PyPI); 2.0b49 (affected, PyPI); 2.0b5 (affected, PyPI); 2.0b50 (affected, PyPI); 2.0b51 (affected, PyPI); 2.0b52 (affected, PyPI); 2.0b53 (affected, PyPI); 2.0b54 (affected, PyPI); 2.0b55 (affected, PyPI); 2.0b57 (affected, PyPI); 2.0b58 (affected, PyPI); 2.0b59 (affected, PyPI); 2.0b60 (affected, PyPI); 2.0b61 (affected, PyPI); 2.0b62 (affected, PyPI); 2.0b63 (affected, PyPI); 2.0b64 (affected, PyPI); 2.0b7 (affected, PyPI); 2.0c1 (affected, PyPI); 2.0c12 (affected, PyPI); 2.0c13 (affected, PyPI); 2.0c2 (affected, PyPI); 2.0c3 (affected, PyPI); 2.0c4 (affected, PyPI); 2.0c5 (affected, PyPI); 2.0c7 (affected, PyPI); 2.0c8 (affected, PyPI); 2.10 (affected, PyPI); 2.10.1 (affected, PyPI); 2.10.2 (affected, PyPI); 2.10.3 (affected, PyPI); 2.10.4 (affected, PyPI); 2.10rc0 (affected, PyPI); 2.10rc1 (affected, PyPI); 2.10rc2 (affected, PyPI); 2.10rc3 (affected, PyPI); 2.10rc4 (affected, PyPI); 2.10rc5 (affected, PyPI); 2.4 (affected, PyPI); 2.4.1 (affected, PyPI); 2.4a1 (affected, PyPI); 2.4a10 (affected, PyPI); 2.4a11 (affected, PyPI); 2.4a12 (affected, PyPI); 2.4a13 (affected, PyPI); 2.4a14 (affected, PyPI); 2.4a15 (affected, PyPI); 2.4a16 (affected, PyPI); 2.4a17 (affected, PyPI); 2.4a18 (affected, PyPI); 2.4a19 (affected, PyPI); 2.4a2 (affected, PyPI); 2.4a20 (affected, PyPI); 2.4a21 (affected, PyPI); 2.4a22 (affected, PyPI); 2.4a23 (affected, PyPI); 2.4a24 (affected, PyPI); 2.4a25 (affected, PyPI); 2.4a26 (affected, PyPI); 2.4a28 (affected, PyPI); 2.4a29 (affected, PyPI); 2.4a3 (affected, PyPI); 2.4a30 (affected, PyPI); 2.4a31 (affected, PyPI); 2.4a32 (affected, PyPI); 2.4a33 (affected, PyPI); 2.4a34 (affected, PyPI); 2.4a35 (affected, PyPI); 2.4a36 (affected, PyPI); 2.4a38 (affected, PyPI); 2.4a4 (affected, PyPI); 2.4a5 (affected, PyPI); 2.4a6 (affected, PyPI); 2.4a7 (affected, PyPI); 2.4a8 (affected, PyPI); 2.4a9 (affected, PyPI); 2.4b1 (affected, PyPI); 2.4b10 (affected, PyPI); 2.4b11 (affected, PyPI); 2.4b12 (affected, PyPI); 2.4b13 (affected, PyPI); 2.4b14 (affected, PyPI); 2.4b15 (affected, PyPI); 2.4b16 (affected, PyPI); 2.4b17 (affected, PyPI); 2.4b18 (affected, PyPI); 2.4b19 (affected, PyPI); 2.4b2 (affected, PyPI); 2.4b20 (affected, PyPI); 2.4b21 (affected, PyPI); 2.4b22 (affected, PyPI); 2.4b23 (affected, PyPI); 2.4b24 (affected, PyPI); 2.4b25 (affected, PyPI); 2.4b26 (affected, PyPI); 2.4b27 (affected, PyPI); 2.4b28 (affected, PyPI); 2.4b3 (affected, PyPI); 2.4b4 (affected, PyPI); 2.4b5 (affected, PyPI); 2.4b6 (affected, PyPI); 2.4b7 (affected, PyPI); 2.4b8 (affected, PyPI); 2.4c1 (affected, PyPI); 2.4c2 (affected, PyPI); 2.4c3 (affected, PyPI); 2.4c4 (affected, PyPI); 2.5.1 (affected, PyPI); 2.5.10 (affected, PyPI); 2.5.12 (affected, PyPI); 2.5.13 (affected, PyPI); 2.5.14 (affected, PyPI); 2.5.15 (affected, PyPI); 2.5.2 (affected, PyPI); 2.5.3 (affected, PyPI); 2.5.4 (affected, PyPI); 2.5.5 (affected, PyPI); 2.5.6 (affected, PyPI); 2.5.7 (affected, PyPI); 2.5.9 (affected, PyPI); 2.5.9.dev20170116091328 (affected, PyPI); 2.5.dev20160825082804 (affected, PyPI); 2.6 (affected, PyPI); 2.6.1 (affected, PyPI); 2.6.2 (affected, PyPI); 2.6.3 (affected, PyPI); 2.6a1 (affected, PyPI); 2.6c1 (affected, PyPI); 2.7 (affected, PyPI); 2.7.1.dev20171013151516 (affected, PyPI); 2.7.2.dev20171013181854 (affected, PyPI); 2.7.4.dev20171114161428 (affected, PyPI); 2.7.5.dev20180123130714 (affected, PyPI); 2.7.5.dev20180125135927 (affected, PyPI); 2.8 (affected, PyPI); 2.8.1 (affected, PyPI); 2.8.1rc0 (affected, PyPI); 2.8rc0 (affected, PyPI); 2.8rc1 (affected, PyPI); 2.8rc10 (affected, PyPI); 2.8rc11 (affected, PyPI); 2.8rc12 (affected, PyPI); 2.8rc13 (affected, PyPI); 2.8rc2 (affected, PyPI); 2.8rc3 (affected, PyPI); 2.8rc4 (affected, PyPI); 2.8rc5 (affected, PyPI); 2.8rc6 (affected, PyPI); 2.8rc7 (affected, PyPI); 2.8rc8 (affected, PyPI); 2.8rc9 (affected, PyPI); 3.0.0 (affected, PyPI); 3.1.0 (affected, PyPI); 3.1.1 (affected, PyPI); 3.2.0 (affected, PyPI); 3.2.1 (affected, PyPI); 3.2.2 (affected, PyPI); 3.2.3 (affected, PyPI); 3.2.3.post1 (affected, PyPI); 3.2.4 (affected, PyPI); 3.3.0 (affected, PyPI); 3.3.1 (affected, PyPI); 3.3.1.post1 (affected, PyPI); 3.3.2 (affected, PyPI); 3.3.2.post1 (affected, PyPI); 3.3.2.post2 (affected, PyPI); 3.3.3 (affected, PyPI); 4.0.0 (affected, PyPI); 4.0.0.post1 (affected, PyPI); 4.0.0rc0 (affected, PyPI); 4.0.0rc1 (affected, PyPI); 4.0.1 (affected, PyPI); 4.0.2 (affected, PyPI); 4.0.3 (affected, PyPI); 4.1.0 (affected, PyPI); 4.1.1 (affected, PyPI); 4.1.2 (affected, PyPI); 4.1.3 (affected, PyPI); 4.1.3.post1 (affected, PyPI); 4.1.4 (affected, PyPI); 4.1.5 (affected, PyPI); 4.2.0 (affected, PyPI); 4.2.1 (affected, PyPI); 4.2.2 (affected, PyPI); 4.2.3 (affected, PyPI); 4.2.4 (affected, PyPI); 4.2.5 (affected, PyPI); 4.3.0 (affected, PyPI); 4.3.0.post1 (affected, PyPI); 4.3.1 (affected, PyPI); 4.4.0 (affected, PyPI); 4.4.1 (affected, PyPI); 4.4.2 (affected, PyPI); 4.4.3 (affected, PyPI); 4.4.4 (affected, PyPI); 4.4.5 (affected, PyPI); 5.0.0 (affected, PyPI); 5.0.1 (affected, PyPI); 5.0.2 (affected, PyPI); Ecosystem version events: introduced 0; fixed 5.0.3. Source: OSV GHSA-r4hm-p9f9-fj9v

## Severity and prioritization

- CVSS 3.1: 6.3 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/GeoNode/geonode/security/advisories/GHSA-r4hm-p9f9-fj9v (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/GeoNode/geonode/pull/14322 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/GeoNode/geonode/pull/14343 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/GeoNode/geonode/commit/0803857b22eba5b55729145ef401b1bc1c23e332 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/GeoNode/geonode/commit/730d8fae206ea5b051f630718aeecae1bf7b5760 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/GeoNode/geonode/releases/tag/5.0.3 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/advisories/GHSA-r4hm-p9f9-fj9v (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-r4hm-p9f9-fj9v (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-55649; retrieved 2026-11-06; source updated 2026-11-06

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-r4hm-p9f9-fj9v; retrieved 2026-11-06; source updated 2026-11-06

Revision: 4edfb08b0c478535633858b63bff271fdc8ce594d5ca2ce03168609599bdb6c5

Canonical: https://y2.dev/cve/CVE-2026-55649

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.