GHSA-9fpx-fr6j-2vh6: GeoNode has OS command injection via uploaded file layer name

• Severity: HIGH
• CVE: CVE-2026-33050
• Ecosystems: pip
• Packages: GeoNode

Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.

Source: GitHub Security Advisories · 2026-11-06