GitHub Advisoryadvisory · PyPI

GHSA-rwcv-whm8-fmxm GeoNode: Stored XSS to full account takeover

MEDIUM Published 2026-07-13 Modified 2026-07-13 Official page ↗
Aliases
CVE-2024-27091
Ecosystem
PyPI
Packages
geonode
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-07-13

Affected packages

• PyPI geonode: >= 3.2.1, < 4.2.3 → fixed in 4.2.3

Description

An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed.

Related

Alias · CVE (1)

  • CVE-2024-27091 GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References