EUVD-2026-116019Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted geometry value to GeometryField form
-
ExploitValue fails GEOS/WKT deserialization
-
ExecutionControl characters written unescaped to error log
-
ImpactForge or inject fake log entries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log output neutralization
|
| Exploitation Conditions | Exploitation requires that the target application use django.contrib.gis.forms.GeometryField or a BaseGeometryWidget subclass (i.e. GeoDjango/contrib.gis forms) and accept attacker-controlled geometry input, and that invalid submissions be logged via the django.contrib.gis error logger. The attacker-controlled value must contain control characters (newlines, ANSI escape sequences, etc.) to achieve log forgery. No authentication is required (PR:N) and no special configuration beyond using the GIS form field, but impact is limited to log integrity and is most meaningful when logs are viewed in terminals or ingested by external systems; applications that do not use contrib.gis geometry form fields are not affected. |
| Impact | This is a genuinely low-priority issue despite a moderate CVSS 4.0 base score of 6.9. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N shows network reach with no authentication or user interaction, but the ONLY impact is a low-level integrity effect (VI:L) on logs - no confidentiality, no availability, no code execution. Django itself rates this 'low' under its security policy, and the vuln.today decision label is 'this_month' rather than act_now/emergency, which is consistent with a log-integrity defect. No EPSS score was provided, there is no CISA KEV listing (no confirmed active exploitation), and no proof-of-concept or exploit reference appears in the input - only vendor patch commits and advisories. The CWE is CWE-117 (improper output neutralization for logs / log injection), NOT code execution, so the 'Code Injection' tag overstates the mechanism. Net: the network-reachable, unauthenticated characteristics make the score look alarming, but real-world risk is contained to log forgery/tampering and only in applications that use the optional GeoDjango GeometryField, so this should be scheduled as routine patching rather than treated as an emergency. |
| Exploit ScenarioDerived | An application that exposes a django.contrib.gis.forms.GeometryField (GeoDjango) accepts user-submitted geometry data. A remote attacker submits an invalid geometry value containing control characters such as newlines or ANSI escape sequences; because deserialize() logged the raw value unescaped, the attacker forges additional fake log lines or manipulates how logs render in terminals or downstream log processors. No public exploit code is identified in the provided sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Log injection in Django's GeoDjango form layer lets remote attackers forge or corrupt application log entries by submitting a crafted geometry value to a form built on django.contrib.gis.forms.GeometryField, because BaseGeometryWidget.deserialize() wrote the rejected input into the django.contrib.gis error log without escaping control characters. Affected releases are Django 6.1 before 6.1.3, 6.0 before 6.0.10 and 5.2 before 5.2.19; older unsupported series (5.1.x, 5.0.x, 4.2.x) were not evaluated by the vendor and may also be affected. The CVSS 4.0 base score is 6.9, but the Django security team classifies the issue as low severity and the practical impact is confined to log integrity - newline or ANSI escape sequences can fake log lines or manipulate terminal output when such logs are viewed or ingested elsewhere. No public exploit code was identified at time of analysis.
RemediationAI
Upgrade to Django 6.1.3, 6.0.10 or 5.2.19, the releases that contain the fix; patch commits are public at https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba, https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793, https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374 and https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a and can be backported if an unsupported branch must be maintained. Because Django's advisory treats the release as the fix, the reliable mitigation is applying the patched version; applications that do not expose django.contrib.gis.forms.GeometryField or BaseGeometryWidget-based forms are not affected and need no change. Where an immediate upgrade is not possible, the exposure is bounded by removing GeoDjango geometry form endpoints from untrusted input or by preventing django.contrib.gis error records from reaching terminal viewers or log-ingestion pipelines that interpret escape sequences, at the cost of losing those diagnostics. Track the vendor security page at https://docs.djangoproject.com/en/dev/releases/security/ for updated release guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-117 (Improper Output Neutralization for Logs): in django/contrib/gis/forms/widgets.py, BaseGeometryWidget.deserialize() called logger.error("Error creating geometry from value '%s' (%s)", value, err) with the raw submitted string whenever the value could not be parsed as WKT, EWKT or HEXEWKB. Any control characters in that string - newlines, ANSI escape sequences, unicode line separators - were therefore written to the django.contrib.gis logger verbatim, allowing an attacker to fabricate additional log records or alter how existing records render in a terminal or downstream log pipeline. The fix routes the message through django.utils.log.log_message() so the interpolated value is escaped, and through django.utils.text.trim_value() to cap the value at 4096 characters with a '<trimmed N chars out of M>' suffix kept outside the escaped argument, which also avoids unbounded log records from very large submissions. The accompanying tests assert that 'line\nbreak', an emoji, and an ANSI colour sequence are logged in escaped form (\n, \U0001f5fa\ufe0f, \x1b[31m) and that a 5000-character value is trimmed. The vulnerable code path is reached only through GeoDjango geometry form fields and widgets, i.e. deployments using the GIS contrib app with attacker-reachable geometry input.
Know when Django gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remote unauthenticated submission of a form value (AV:N/AC:L/PR:N/UI:N); only log integrity is affected, so I:L and C:N/A:N, scope unchanged.
Primary rating from Vendor (DSF).
CVSS VectorVendor: DSF
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize(), used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9
In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. Rated critical severity (CVSS 9.8), this vulne
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. Rated critical severity (CVSS 9.8
An authentication/authorization bypass in the djust Python live-view framework (versions prior to 1.0.7) lets unauthenti
Unauthenticated arbitrary Python module import in djust before 1.0.7 lets any client that can reach the WebSocket or SSE
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a
Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/j
Forged content modification in django-page-cms through 2.0.13 lets unauthenticated remote attackers exploit five CSRF-ex
Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cros
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through dju
Exploit-DB