CVE-2026-111211
Potential log injection via unescaped geometry form values
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Potential log injection via unescaped geometry form values
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
- Record
CVE-2026-111211- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-117
- Updated
- 2026-11-03
EUVDEUVD-2026-116019
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
- Record
EUVD-2026-116019- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cc89-hg86-h2hx
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. ...
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
- Record
GHSA-cc89-hg86-h2hx- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-117
- Updated
- 2026-11-03
NVD
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
- Record
CVE-2026-111211- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-117
- Updated
- 2026-11-03
OSVALPINE-CVE-2026-111211
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
- Record
ALPINE-CVE-2026-111211- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-04
OSV
Potential log injection via unescaped geometry form values
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
- Record
CVE-2026-111211- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-117
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-111211
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
- Record
DEBIAN-CVE-2026-111211- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-111211
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
- Record
UBUNTU-CVE-2026-111211- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
py3-djangoAlpine:v3.24 |
before 5.2.19-r0 | 5.2.19-r0 |
python-djangoDebian:12 |
All versions, plus listed versions 3:3.2.19-13:3.2.19-1+deb12u13:3.2.19-1+deb12u1~bpo11+13:3.2.19-1+deb12u23:3.2.20-1 Show 45 moreShow less3:3.2.20-1.13:3.2.21-13:3.2.25-0+deb12u13:3.2.25-0+deb12u23:3.2.25-0+deb12u33:3.2.25-0+deb12u43:3.2.25-0+deb12u53:3.2.25-0+deb12u63:4.1-13:4.1.1-13:4.1.2-13:4.1.3-13:4.1.4-13:4.1.5-13:4.2-13:4.2.1-13:4.2.10-13:4.2.11-13:4.2.13-13:4.2.14-13:4.2.15-13:4.2.15-1~bpo12+13:4.2.16-13:4.2.17-13:4.2.17-23:4.2.18-13:4.2.18-1~bpo12+13:4.2.19-13:4.2.19-1~bpo12+13:4.2.2-13:4.2.20-13:4.2.20-1~bpo12+13:4.2.21-13:4.2.21-1~bpo12+13:4.2.22-13:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-13:4.2.27-13:4.2.27-23:4.2.28-13:4.2.29-13:4.2.3-1 |
None known |
python-djangoDebian:13 |
All versions, plus listed versions 3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1 Show 45 moreShow less3:4.2.27-0+deb13u13:4.2.27-13:4.2.27-23:4.2.28-0+deb13u13:4.2.28-0+deb13u23:4.2.28-13:4.2.29-13:4.2.30-13:5.0-13:5.0.1-13:5.0.2-13:5.0.3-13:5.0.4-13:5.0.6-13:5.0~alpha1-13:5.0~rc1-13:5.1-13:5.1.1-13:5.1.2-13:5.1.3-13:5.1.4-13:5.1.5-13:5.1~alpha1-13:5.1~beta1-13:5.1~rc1-13:5.2-13:5.2.1-13:5.2.13-13:5.2.14-13:5.2.14-23:5.2.15-13:5.2.15-23:5.2.15-2~bpo13+13:5.2.16-13:5.2.16-1~bpo13+13:5.2.17-13:5.2.17-23:5.2.17-2~bpo13+13:5.2.18-13:5.2.18-23:5.2.19-13:5.2.2-13:5.2.3-13:5.2.4-13:5.2.5-1 |
None known |
python-djangoDebian:14 |
All versions, plus listed versions 3:4.2.23-13:4.2.24-13:4.2.25-13:4.2.25-23:4.2.26-1 Show 45 moreShow less3:4.2.27-13:4.2.27-23:4.2.28-13:4.2.29-13:4.2.30-13:5.0-13:5.0.1-13:5.0.2-13:5.0.3-13:5.0.4-13:5.0.6-13:5.0~alpha1-13:5.0~rc1-13:5.1-13:5.1.1-13:5.1.2-13:5.1.3-13:5.1.4-13:5.1.5-13:5.1~alpha1-13:5.1~beta1-13:5.1~rc1-13:5.2-13:5.2.1-13:5.2.13-13:5.2.14-13:5.2.14-23:5.2.15-13:5.2.15-23:5.2.15-2~bpo13+13:5.2.16-13:5.2.16-1~bpo13+13:5.2.17-13:5.2.17-23:5.2.17-2~bpo13+13:5.2.18-13:5.2.18-23:5.2.19-13:5.2.2-13:5.2.3-13:5.2.4-13:5.2.5-13:5.2.6-13:5.2~alpha1-13:5.2~beta1-1 |
None known |
python-djangoUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.5.4-1ubuntu11.6-11.6.1-11.6.1-21.6.1-2ubuntu0.1 Show 30 moreShow less1.6.1-2ubuntu0.21.6.1-2ubuntu0.31.6.1-2ubuntu0.41.6.1-2ubuntu0.51.6.1-2ubuntu0.61.6.1-2ubuntu0.81.6.1-2ubuntu0.91.6.1-2ubuntu0.101.6.1-2ubuntu0.111.6.1-2ubuntu0.121.6.1-2ubuntu0.131.6.1-2ubuntu0.141.6.1-2ubuntu0.151.6.1-2ubuntu0.161.6.11-0ubuntu11.6.11-0ubuntu1.11.6.11-0ubuntu1.21.6.11-0ubuntu1.31.6.11-0ubuntu1.3+esm11.6.11-0ubuntu1.3+esm21.6.11-0ubuntu1.3+esm31.6.11-0ubuntu1.3+esm41.6.11-0ubuntu1.3+esm51.6.11-0ubuntu1.3+esm61.6.11-0ubuntu1.3+esm71.6.11-0ubuntu1.3+esm81.6.11-0ubuntu1.3+esm91.6.11-0ubuntu1.3+esm101.6.11-0ubuntu1.3+esm111.6.11-0ubuntu1.3+esm12 |
None known |
python-djangoUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.7.9-1ubuntu51.8.5-2ubuntu11.8.7-1ubuntu11.8.7-1ubuntu21.8.7-1ubuntu3 Show 28 moreShow less1.8.7-1ubuntu41.8.7-1ubuntu51.8.7-1ubuntu5.11.8.7-1ubuntu5.21.8.7-1ubuntu5.41.8.7-1ubuntu5.51.8.7-1ubuntu5.61.8.7-1ubuntu5.71.8.7-1ubuntu5.81.8.7-1ubuntu5.91.8.7-1ubuntu5.101.8.7-1ubuntu5.111.8.7-1ubuntu5.121.8.7-1ubuntu5.131.8.7-1ubuntu5.141.8.7-1ubuntu5.151.8.7-1ubuntu5.15+esm11.8.7-1ubuntu5.15+esm31.8.7-1ubuntu5.15+esm41.8.7-1ubuntu5.15+esm51.8.7-1ubuntu5.15+esm61.8.7-1ubuntu5.15+esm71.8.7-1ubuntu5.15+esm81.8.7-1ubuntu5.15+esm91.8.7-1ubuntu5.15+esm101.8.7-1ubuntu5.15+esm111.8.7-1ubuntu5.15+esm121.8.7-1ubuntu5.15+esm13 |
None known |
python-djangoUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:1.11.4-1ubuntu11:1.11.6-1ubuntu11:1.11.9-1ubuntu11:1.11.11-1ubuntu11:1.11.11-1ubuntu1.1 Show 36 moreShow less1:1.11.11-1ubuntu1.21:1.11.11-1ubuntu1.31:1.11.11-1ubuntu1.41:1.11.11-1ubuntu1.51:1.11.11-1ubuntu1.61:1.11.11-1ubuntu1.71:1.11.11-1ubuntu1.81:1.11.11-1ubuntu1.91:1.11.11-1ubuntu1.101:1.11.11-1ubuntu1.111:1.11.11-1ubuntu1.121:1.11.11-1ubuntu1.131:1.11.11-1ubuntu1.141:1.11.11-1ubuntu1.151:1.11.11-1ubuntu1.161:1.11.11-1ubuntu1.171:1.11.11-1ubuntu1.181:1.11.11-1ubuntu1.191:1.11.11-1ubuntu1.201:1.11.11-1ubuntu1.211:1.11.11-1ubuntu1.21+esm11:1.11.11-1ubuntu1.21+esm21:1.11.11-1ubuntu1.21+esm31:1.11.11-1ubuntu1.21+esm41:1.11.11-1ubuntu1.21+esm51:1.11.11-1ubuntu1.21+esm61:1.11.11-1ubuntu1.21+esm71:1.11.11-1ubuntu1.21+esm81:1.11.11-1ubuntu1.21+esm91:1.11.11-1ubuntu1.21+esm101:1.11.11-1ubuntu1.21+esm111:1.11.11-1ubuntu1.21+esm121:1.11.11-1ubuntu1.21+esm131:1.11.11-1ubuntu1.21+esm141:1.11.11-1ubuntu1.21+esm151:1.11.11-1ubuntu1.21+esm17 |
None known |
python-djangoUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.11.22-1ubuntu12:2.2.6-1ubuntu12:2.2.9-2ubuntu12:2.2.10-12:2.2.10-1ubuntu1 Show 40 moreShow less2:2.2.11-12:2.2.12-12:2.2.12-1ubuntu0.12:2.2.12-1ubuntu0.22:2.2.12-1ubuntu0.32:2.2.12-1ubuntu0.42:2.2.12-1ubuntu0.52:2.2.12-1ubuntu0.62:2.2.12-1ubuntu0.72:2.2.12-1ubuntu0.82:2.2.12-1ubuntu0.92:2.2.12-1ubuntu0.102:2.2.12-1ubuntu0.112:2.2.12-1ubuntu0.122:2.2.12-1ubuntu0.132:2.2.12-1ubuntu0.142:2.2.12-1ubuntu0.152:2.2.12-1ubuntu0.162:2.2.12-1ubuntu0.172:2.2.12-1ubuntu0.182:2.2.12-1ubuntu0.192:2.2.12-1ubuntu0.202:2.2.12-1ubuntu0.212:2.2.12-1ubuntu0.222:2.2.12-1ubuntu0.232:2.2.12-1ubuntu0.242:2.2.12-1ubuntu0.252:2.2.12-1ubuntu0.262:2.2.12-1ubuntu0.272:2.2.12-1ubuntu0.282:2.2.12-1ubuntu0.292:2.2.12-1ubuntu0.29+esm12:2.2.12-1ubuntu0.29+esm22:2.2.12-1ubuntu0.29+esm32:2.2.12-1ubuntu0.29+esm42:2.2.12-1ubuntu0.29+esm52:2.2.12-1ubuntu0.29+esm62:2.2.12-1ubuntu0.29+esm72:2.2.12-1ubuntu0.29+esm82:2.2.12-1ubuntu0.29+esm10 |
None known |
python-djangoUbuntu:22.04:LTS |
All versions, plus listed versions 2:2.2.24-1ubuntu12:3.2.12-22:3.2.12-2ubuntu12:3.2.12-2ubuntu1.12:3.2.12-2ubuntu1.2 Show 26 moreShow less2:3.2.12-2ubuntu1.32:3.2.12-2ubuntu1.42:3.2.12-2ubuntu1.52:3.2.12-2ubuntu1.62:3.2.12-2ubuntu1.72:3.2.12-2ubuntu1.82:3.2.12-2ubuntu1.92:3.2.12-2ubuntu1.102:3.2.12-2ubuntu1.112:3.2.12-2ubuntu1.122:3.2.12-2ubuntu1.132:3.2.12-2ubuntu1.142:3.2.12-2ubuntu1.152:3.2.12-2ubuntu1.162:3.2.12-2ubuntu1.172:3.2.12-2ubuntu1.182:3.2.12-2ubuntu1.192:3.2.12-2ubuntu1.202:3.2.12-2ubuntu1.212:3.2.12-2ubuntu1.222:3.2.12-2ubuntu1.232:3.2.12-2ubuntu1.242:3.2.12-2ubuntu1.252:3.2.12-2ubuntu1.262:3.2.12-2ubuntu1.272:3.2.12-2ubuntu1.29 |
None known |
python-djangoUbuntu:24.04:LTS |
All versions, plus listed versions 3:4.2.4-1ubuntu23:4.2.8-13:4.2.9-13:4.2.11-13:4.2.11-1ubuntu1 Show 17 moreShow less3:4.2.11-1ubuntu1.13:4.2.11-1ubuntu1.23:4.2.11-1ubuntu1.33:4.2.11-1ubuntu1.43:4.2.11-1ubuntu1.53:4.2.11-1ubuntu1.63:4.2.11-1ubuntu1.73:4.2.11-1ubuntu1.83:4.2.11-1ubuntu1.93:4.2.11-1ubuntu1.103:4.2.11-1ubuntu1.113:4.2.11-1ubuntu1.123:4.2.11-1ubuntu1.133:4.2.11-1ubuntu1.143:4.2.11-1ubuntu1.153:4.2.11-1ubuntu1.163:4.2.11-1ubuntu1.18 |
None known |
python-djangoUbuntu:26.10 |
All versions, plus listed versions 3:5.2.9-0ubuntu43:5.2.16-13:5.2.17-1 |
None known |
python-djangoUbuntu:26.04:LTS |
All versions, plus listed versions 3:5.2.4-1ubuntu23:5.2.4-1ubuntu33:5.2.9-0ubuntu13:5.2.9-0ubuntu23:5.2.9-0ubuntu33:5.2.9-0ubuntu43:5.2.9-0ubuntu4.13:5.2.9-0ubuntu4.3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| published | OSV | |
| references | OSV | |
| affected, aliases, facts, references | OSV | |
| affected | OSV | |
| affected, aliases, published, references | OSV | |
| references | OSV | |
| affected, aliases, references | OSV | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | CVE List, GitHub Advisories, NVD | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-111211 is a medium vulnerability (CVSS 6.9) in Djangoproject Django, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in py3-django 5.2.19-r0.
References
docs.djangoproject.com/en/dev/releases/security
groups.google.com/g/django-announce
github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba
Show 10 moreShow less
djangoproject.com/weblog/2026/nov/03/security-releases
nvd.nist.gov/vuln/detail/CVE-2026-111211
security.alpinelinux.org/vuln/CVE-2026-111211
pypi.org/project/Django
security-tracker.debian.org/tracker/CVE-2026-111211
ubuntu.com/security/CVE-2026-111211
cve.org/CVERecord?id=CVE-2026-111211
Left out here: 104 versions. The JSON record has them.