Detections
Analytics

CVE-2026-111211

medium

Description

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.

References

https://www.djangoproject.com/weblog/2026/nov/03/security-releases/

https://docs.djangoproject.com/en/dev/releases/security/

https://groups.google.com/g/django-announce

https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a

https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793

https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba

https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116019

Details

Source: Mitre, NVD

Published: 2026-11-03

Updated: 2026-11-03

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00534