CVE-2026-111211
mediumAn issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://docs.djangoproject.com/en/dev/releases/security/ 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- https://groups.google.com/g/django-announce 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- https://www.djangoproject.com/weblog/2026/nov/03/security-releases/ 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92