Django GeometryField Vulnerability in Affected Versions
CVE-2026-111211

6.9MEDIUM

Key Information:

Vendor

Djangoproject

Status
Django
Vendor
CVE Published:
3 November 2026

What is CVE-2026-111211?

An issue has been identified in specific Django versions where the BaseGeometryWidget's deserialize method fails to properly escape invalid values before logging. This oversight may allow remote attackers to inject or forge log entries by submitting malformed geometry values. Affected versions include Django 6.1 prior to 6.1.3, Django 6.0 before 6.0.10, and Django 5.2 until 5.2.19, with unsupported earlier versions potentially impacted as well. The Django team acknowledges Aaron Chen for reporting this critical issue.

Affected Version(s)

Django 6.1 < 6.1.3

Django 6.0 < 6.0.10

Django 5.2 < 5.2.19

References

https://docs.djangoproject.com/en/dev/releases/security/
vendor-advisory
https://groups.google.com/g/django-announce
mailing-list
https://github.com/django/django/commit/af4319f7217e33ad5...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron chen
David Smith
Jake Howard
Jacob Walls
Natalia Bidart
David Smith
Jacob Walls
Natalia Bidart
Shai Berger
Jacob Walls
.