{"id":"CVE-2025-69662","aliases":["GHSA-6497-prx7-gpmq","PYSEC-2026-62"],"url":"https://o3.security/vulnerability/CVE-2025-69662","summary":"geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure","details":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","published":"2026-01-30T00:00:00Z","modified":"2026-08-12T03:51:21.972269350Z","cvss":{"score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"geopandas","fixedVersion":"1.1.2"}],"fix":{"url":"https://github.com/geopandas/geopandas/pull/3681","label":"geopandas/geopandas#3681"},"references":[{"type":"WEB","url":"https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69662.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69662"},{"type":"FIX","url":"https://github.com/geopandas/geopandas/pull/3681"},{"type":"WEB","url":"https://github.com/geopandas/geopandas/issues/3679"},{"type":"WEB","url":"https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419"},{"type":"WEB","url":"https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas"},{"type":"PACKAGE","url":"https://github.com/geopandas/geopandas"},{"type":"WEB","url":"https://github.com/geopandas/geopandas/releases/tag/v1.1.2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/geopandas/PYSEC-2026-62.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:21.972269350Z"}}