Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/geonode@4.2.2
purl pkg:pypi/geonode@4.2.2
Next non-vulnerable version 4.4.5
Latest non-vulnerable version 5.0.2
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-zfm7-uxa4-m7c9
Aliases:
CVE-2026-39922
GHSA-hw9r-6m78-w6h3
PYSEC-2026-61
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Attackers can probe internal network targets including loopback addresses, RFC1918 private IP ranges, link-local addresses, and cloud metadata services by exploiting insufficient URL validation in the WMS service handler without private IP filtering or allowlist enforcement.
4.4.5
Affected by 0 other vulnerabilities.
5.0.2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T04:21:42.696240+00:00 Pypa Importer Affected by VCID-zfm7-uxa4-m7c9 https://github.com/pypa/advisory-database/blob/main/vulns/geonode/PYSEC-2026-61.yaml 38.6.0
2026-06-11T21:05:54.346026+00:00 PyPI Importer Affected by VCID-zfm7-uxa4-m7c9 https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.6.0