Remote Code Execution Vulnerability in Django GIS Products
CVE-2026-111362

6.9MEDIUM

Key Information:

Vendor

Djangoproject

Status
Django
Vendor
CVE Published:
3 November 2026

What is CVE-2026-111362?

A vulnerability in Django's django.contrib.gis.gdal.OGRGeometry allows attackers to exploit unrestrained coordinate reference system definitions in GeoJSON inputs. By crafting malicious crs members, a remote attacker could initiate server-side requests to any destination of their choosing. This issue affects various versions of Django, specifically those prior to 6.1.3, 6.0.10, and 5.2.19. While earlier unsupported versions, including 5.1.x, 5.0.x, and 4.2.x, have not undergone evaluation, they may also be vulnerable. The Django Software Foundation has acknowledged the Submersion Security Research Team for identifying this vulnerability.

Affected Version(s)

Django 6.1 < 6.1.3

Django 6.0 < 6.0.10

Django 5.2 < 5.2.19

References

https://docs.djangoproject.com/en/dev/releases/security/
vendor-advisory
https://groups.google.com/g/django-announce
mailing-list
https://github.com/django/django/commit/ecb2b77b49890d6b2...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Submersion Security Research Team
Ken Whitesell
David Smith
Jacob Walls
Sarah Boyce
Jacob Walls
David Smith
Sarah Boyce
Jacob Walls
.