GeoNode CVE-2026-55649

Exploitation requires an authenticated GeoNode account with at least low-privilege rights sufficient to create or edit a document and populate its abstract metadata field (PR:L) - it is NOT exploitable by an unauthenticated attacker. The malicious payload only fires when a second user (UI:R) navigates to the affected document's page, so a victim visit is a hard prerequisite. The flaw affects default configurations of GeoNode prior to 5.0.3 because the abstract field was stored without sanitization; no special feature toggle or non-default setting is needed. Limiting factors that reduce real-world risk: the need for a valid account, the dependency on victim interaction, and the absence of any confirmed active exploitation or public exploit.

This is a moderate-severity stored cross-site scripting flaw (CWE-79) in GeoNode's document abstract metadata field, rated CVSS 6.3 by the source. The CVSS vector (AV:N/AC:L/PR:L/UI:R) describes a network-reachable, low-complexity attack that nonetheless requires an authenticated low-privileged account (PR:L) AND victim interaction (UI:R) - two meaningful limiters that keep this out of 'drive-by' territory. The GHSA advisory and the merged fix PRs confirm the vulnerability and the sanitization gap, so the flaw itself is well-substantiated. On the threat side, however, the escalating signals are weak: there is no CISA KEV listing, no EPSS probability was supplied, no SSVC decision was provided, and the references are limited to the advisory, patch PRs, commits, and the 5.0.3 release - none of which is a working exploit. The only prioritization signal present is the vuln.today 'this_month' label, which is consistent with a real-but-not-emergency stored XSS. Net assessment: a genuine, patch-worthy issue appropriate for routine monthly remediation rather than emergency response - the requirement for both authentication and a victim visiting the crafted document page materially bounds real-world exploitability. Note one divergence worth verifying: the source scores C:H with S:U, but stored XSS impact typically manifests in a different security scope (the victim's browser) with lower per-tenant confidentiality impact, so the real-world impact profile may be closer to a scope-changed, lower-confidentiality XSS than the C:H rating implies.

A low-privileged authenticated GeoNode user creates or edits a document and plants arbitrary HTML/JavaScript in the unsanitized abstract metadata field. When another user - for example an administrator or data curator - later opens that document's page, the stored script executes in their browser session, enabling session token theft, actions performed as the victim, or UI manipulation. No public exploit or proof-of-concept reference was identified in the provided data, though the straightforward nature of stored XSS makes exploitation technically simple once an account is obtained.