{"id":"CVE-2026-33050","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-33050","summary":"GeoNode has OS command injection via uploaded file layer name","details":"Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.","published":"2026-11-06T19:39:38Z","modified":"2026-11-06T19:45:05.134638894Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"geonode","fixedVersion":"5.1.0"}],"fix":{"url":"https://github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180","label":"GeoNode/geonode@1408290"},"references":[{"type":"WEB","url":"https://github.com/GeoNode/geonode/security/advisories/GHSA-9fpx-fr6j-2vh6"},{"type":"WEB","url":"https://github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180"},{"type":"PACKAGE","url":"https://github.com/GeoNode/geonode"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-06T19:45:05.134638894Z"}}