CVE-2025-69662
geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
CVE-2025-69662- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2025-206572
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
EUVD-2025-206572- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6497-prx7-gpmq
geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
GHSA-6497-prx7-gpmq- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-89, CWE-202
- Updated
- 2026-11-02
NVD
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
CVE-2025-69662- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
CVE-2025-69662- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-69662
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
DEBIAN-CVE-2025-69662- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-06
Show 4 moreShow less
OSVGHSA-6497-prx7-gpmq
geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
GHSA-6497-prx7-gpmq- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-202, CWE-89
- Updated
- 2026-11-02
OSVPYSEC-2026-62
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
PYSEC-2026-62- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-69662
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
- Record
UBUNTU-CVE-2025-69662- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUSN-8083-1 No score
python-geopandas vulnerability
It was discovered that GeoPandas incorrectly handled certain input. An attacker could possibly use this issue to perform SQL injection attacks.
- Record
USN-8083-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
geopandasPyPI |
before 1.1.2 | 1.1.2 |
python-geopandasDebian:12 |
All versions, plus listed versions 0.12.2-10.13.0-1~exp10.13.2-10.13.2-1~exp10.13.2-2 Show 20 moreShow less0.13.2-30.14.0-10.14.1-10.14.2-10.14.3-10.14.3-20.14.4-11.0.1-11.0.1-21.1.0-1~exp11.1.1-11.1.1-1~exp11.1.1-21.1.2-11.1.2-21.1.3-11.1.3-21.1.4-11.1.4-21.2.0-1 |
None known |
python-geopandasDebian:13 |
All versions, plus listed versions 1.0.1-21.1.0-1~exp11.1.1-11.1.1-1~exp11.1.1-2 Show 7 moreShow less1.1.2-11.1.2-21.1.3-11.1.3-21.1.4-11.1.4-21.2.0-1 |
None known |
geopandasPyPI |
before 1.1.2, plus listed versions 0.1.00.1.0.dev-120828c0.1.0.dev-120d5ee0.1.0.dev-189a35c0.1.0.dev-1edddad Show 45 moreShow less0.1.0.dev-2be7de80.1.0.dev-2d642e00.1.0.dev-3ebcae00.1.0.dev-40ec1040.1.0.dev-53f669a0.1.0.dev-6c816f00.1.0.dev-7788a170.1.0.dev-8144a450.1.0.dev-a7b594e0.1.0.dev-a91e8ab0.1.0.dev-abb41370.1.0.dev-c770a5c0.1.0.dev-fea5c400.1.10.10.00.10.10.10.20.11.00.11.10.12.00.12.10.12.20.13.00.13.10.13.20.14.00.14.10.14.20.14.30.14.40.1dev0.20.2.10.3.00.4.00.4.10.5.00.5.10.6.00.6.0rc10.6.10.6.20.6.30.7.00.8.0 |
1.1.2 |
python-geopandasUbuntu:22.04:LTS |
before 0.10.2-1ubuntu0.1, plus listed versions 0.8.2-10.10.2-1 |
0.10.2-1ubuntu0.1 |
python-geopandasUbuntu:24.04:LTS |
before 0.14.3-2ubuntu0.1, plus listed versions 0.13.2-30.14.0-10.14.1-10.14.2-10.14.3-10.14.3-2 |
0.14.3-2ubuntu0.1 |
python-geopandasUbuntu:25.10 |
before 1.0.1-2ubuntu0.1, plus listed versions 1.0.1-11.0.1-2 |
1.0.1-2ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-69662 is a high vulnerability (CVSS 8.6) in Geopandas, published January 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in geopandas 1.1.2.
References
aydinnyunus.github.io/2025/12/27/sql-injection-geopandas
github.com/geopandas/geopandas/pull/3681
lists.debian.org/debian-lts-announce/2026/04/msg00025.html
nvd.nist.gov/vuln/detail/CVE-2025-69662
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2025-69662
ubuntu.com/security/CVE-2025-69662
cve.org/CVERecord?id=CVE-2025-69662
Left out here: 9 versions. The JSON record has them.