GeoNode EUVD-2026-118477

Requires an authenticated account with permission to upload a vector dataset (PR:L); the attacker supplies a crafted layer/original file name containing shell metacharacters that GeoNode passes into the ogr2ogr import command executed via shell=True in geonode/upload/handlers/common/vector.py. Limiting factors: exploitation needs a valid low-privilege account with upload rights (no anonymous path indicated), and affected versions are those prior to 5.1.0; no user interaction beyond the attacker's own upload is required. No special non-default configuration is described as necessary - the vulnerable command construction is in the standard upload handler.

This is a genuine priority, consistent across the available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only a low-privileged account, yielding full C:H/I:H/A:H impact - OS command execution on the GeoNode server (CWE-78), confirmed by the GeoNode GHSA advisory and the fixing commit. The vuln.today decision label is 'this_week', aligning with a high-impact but authentication-gated issue rather than an emergency. No EPSS score and no KEV status were supplied, so widespread or active exploitation cannot be asserted; this is 'no public exploit identified at time of analysis'. However, the fixing commit is public and clearly shows the unsanitized layer name flowing into an ogr2ogr command run with shell=True, which materially lowers the bar for an attacker to reconstruct an exploit even though no working PoC is provided. Net: a real, high-severity RCE whose only meaningful barrier is possession of a low-privilege upload-capable account; patch within the vendor-indicated 'this_week' window.

An attacker holding (or registering for) a low-privileged GeoNode account uploads a vector dataset whose layer/file name embeds shell metacharacters. When GeoNode builds the ogr2ogr import command and runs it through a shell, the injected syntax executes, giving the attacker arbitrary OS command execution as the GeoNode service account. No public working exploit is provided, but the fixing commit publicly reveals the exact injection point.