What is the CVSS score of CVE-2025-69662?

CVE-2025-69662 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PostgreSQL are affected by CVE-2025-69662?

A SQL injection vulnerability in geopandas versions before 1.1.2 could allow attackers to extract sensitive data from PostgreSQL databases when organizations use the to_postgis() function to write…. A patch is available.

Is there a public PoC exploit available for CVE-2025-69662?

Yes, a public proof-of-concept exploit is available for CVE-2025-69662. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-69662?

Within 24 hours: Identify all systems and applications using geopandas versions prior to 1.1.2, particularly those connected to production PostgreSQL databases. Within 7 days: Upgrade geopandas to version 1.1.2 or later across all affected systems; prioritize production environments. Within 30 days: Complete comprehensive patching of all development, testing, and non-production systems; conduct security testing to validate the patch deployment.

PostgreSQL CVE-2025-69662

HIGH

SQL Injection (CWE-89)

2026-01-30 cve@mitre.org

GHSA-6497-prx7-gpmq

PostgreSQL SQLi pandas

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 19:22 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Feb 11, 2026 - 18:58 vuln.today

Public exploit code

Patch released

Feb 11, 2026 - 18:58 nvd

Patch available

CVE Published

Jan 30, 2026 - 19:16 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

18 pypi packages depend on geopandas (16 direct, 2 indirect)

Ecosystem-wide dependent count for version 1.1.2.

DescriptionCVE.org

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

AnalysisAI

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database. [CVSS 8.6 HIGH]

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects Geopandas. SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

RemediationAI

A vendor patch is available — apply it immediately. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.