{"id":"CVE-2025-69662","aliases":["DEBIAN-CVE-2025-69662","EUVD-2025-206572","GHSA-6497-prx7-gpmq","PYSEC-2026-62","UBUNTU-CVE-2025-69662","USN-8083-1"],"status":"published","title":"geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00427,"percentile":0.37255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-202","CWE-89"],"published":"2026-01-30T00:00:00Z","modified":"2026-11-06T17:28:55Z","fixes":[{"ecosystem":"PyPI","package":"geopandas","fixed_in":["1.1.2"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-geopandas","fixed_in":["0.10.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-geopandas","fixed_in":["0.14.3-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"python-geopandas","fixed_in":["1.0.1-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.2-1","0.13.0-1~exp1","0.13.2-1","0.13.2-1~exp1","0.13.2-2","0.13.2-3","0.14.0-1","0.14.1-1","0.14.2-1","0.14.3-1","0.14.3-2","0.14.4-1","1.0.1-1","1.0.1-2","1.1.0-1~exp1","1.1.1-1","1.1.1-1~exp1","1.1.1-2","1.1.2-1","1.1.2-2","1.1.3-1","1.1.3-2","1.1.4-1","1.1.4-2","1.2.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-2","1.1.0-1~exp1","1.1.1-1","1.1.1-1~exp1","1.1.1-2","1.1.2-1","1.1.2-2","1.1.3-1","1.1.3-2","1.1.4-1","1.1.4-2","1.2.0-1"]},{"source":"osv","ecosystem":"PyPI","package":"geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}],"versions":["0.1.0","0.1.0.dev-120828c","0.1.0.dev-120d5ee","0.1.0.dev-189a35c","0.1.0.dev-1edddad","0.1.0.dev-2be7de8","0.1.0.dev-2d642e0","0.1.0.dev-3ebcae0","0.1.0.dev-40ec104","0.1.0.dev-53f669a","0.1.0.dev-6c816f0","0.1.0.dev-7788a17","0.1.0.dev-8144a45","0.1.0.dev-a7b594e","0.1.0.dev-a91e8ab","0.1.0.dev-abb4137","0.1.0.dev-c770a5c","0.1.0.dev-fea5c40","0.1.1","0.10.0","0.10.1","0.10.2","0.11.0","0.11.1","0.12.0","0.12.1","0.12.2","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.1dev","0.2","0.2.1","0.3.0","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.6.0rc1","0.6.1","0.6.2","0.6.3","0.7.0","0.8.0","0.8.1","0.8.2","0.9.0","1.0.0","1.0.0a1","1.0.0rc1","1.0.1","1.1.0","1.1.1"]},{"source":"osv","ecosystem":"PyPI","package":"geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}],"versions":["0.1.0","0.1.0.dev-120828c","0.1.0.dev-120d5ee","0.1.0.dev-189a35c","0.1.0.dev-1edddad","0.1.0.dev-2be7de8","0.1.0.dev-2d642e0","0.1.0.dev-3ebcae0","0.1.0.dev-40ec104","0.1.0.dev-53f669a","0.1.0.dev-6c816f0","0.1.0.dev-7788a17","0.1.0.dev-8144a45","0.1.0.dev-a7b594e","0.1.0.dev-a91e8ab","0.1.0.dev-abb4137","0.1.0.dev-c770a5c","0.1.0.dev-fea5c40","0.1.1","0.10.0","0.10.1","0.10.2","0.11.0","0.11.1","0.12.0","0.12.1","0.12.2","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.14.2","0.14.3","0.14.4","0.1dev","0.2","0.2.1","0.3.0","0.4.0","0.4.1","0.5.0","0.5.1","0.6.0","0.6.0rc1","0.6.1","0.6.2","0.6.3","0.7.0","0.8.0","0.8.1","0.8.2","0.9.0","1.0.0","1.0.0a1","1.0.0rc1","1.0.1","1.1.0","1.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1ubuntu0.1"}]}],"versions":["0.8.2-1","0.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.3-2ubuntu0.1"}]}],"versions":["0.13.2-3","0.14.0-1","0.14.1-1","0.14.2-1","0.14.3-1","0.14.3-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2ubuntu0.1"}]}],"versions":["1.0.1-1","1.0.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1ubuntu0.1"}]}],"versions":["0.8.2-1","0.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.3-2ubuntu0.1"}]}],"versions":["0.13.2-3","0.14.0-1","0.14.1-1","0.14.2-1","0.14.3-1","0.14.3-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-geopandas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2ubuntu0.1"}]}],"versions":["1.0.1-1","1.0.1-2"]}],"products":[{"vendor":"geopandas","product":"geopandas"}],"references":[{"url":"https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas/","tags":["Exploit","Third Party Advisory","web","evidence","report"]},{"url":"https://github.com/geopandas/geopandas/pull/3681","tags":["Issue Tracking","Patch","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69662","tags":["advisory"]},{"url":"https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas","tags":["web"]},{"url":"https://github.com/geopandas/geopandas/issues/3679","tags":["web"]},{"url":"https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419","tags":["web"]},{"url":"https://github.com/geopandas/geopandas/releases/tag/v1.1.2","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/geopandas/PYSEC-2026-62.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6497-prx7-gpmq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69662.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-69662","tags":["advisory"]},{"url":"https://github.com/geopandas/geopandas","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-69662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69662","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8083-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-69662","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T00:00:00Z","modified":"2026-04-21T18:22:26.627Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-206572","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T00:00:00Z","modified":"2026-04-21T18:22:26Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:24:21.512647Z"}],"ghsa":[{"id":"GHSA-6497-prx7-gpmq","title":"geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T21:30:22Z","modified":"2026-06-05T17:56:23Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89","CWE-202"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2025-69662","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T19:16:11.967Z","modified":"2026-06-17T10:00:49.337Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:11:59.832225Z"}],"osv":[{"id":"CVE-2025-69662","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T00:00:00Z","modified":"2026-10-28T02:30:27.340095344Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"DEBIAN-CVE-2025-69662","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T19:16:11.967Z","modified":"2026-11-06T17:28:55.44929554Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-06T18:00:26.717991Z"},{"id":"GHSA-6497-prx7-gpmq","title":"geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T21:30:22Z","modified":"2026-06-05T18:00:13.818427216Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-202","CWE-89"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"PYSEC-2026-62","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T19:16:11.967Z","modified":"2026-06-10T17:01:18.172032507Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"UBUNTU-CVE-2025-69662","description":"SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.","status":"published","published":"2026-01-30T19:16:00Z","modified":"2026-03-14T09:16:23.39656Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"USN-8083-1","title":"python-geopandas vulnerability","description":"It was discovered that GeoPandas incorrectly handled certain input. An\nattacker could possibly use this issue to perform SQL injection attacks.","status":"published","published":"2026-03-11T09:05:26Z","modified":"2026-03-14T09:29:04.161858Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}