CVE-2026-33050: GeoNode has OS command injection via uploaded file layer name

November 6, 2026

Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name.

References

github.com/GeoNode/geonode/commit/1408290c0bb54872924a9b334a516db9758a2180
github.com/GeoNode/geonode/security/advisories/GHSA-9fpx-fr6j-2vh6
github.com/advisories/GHSA-9fpx-fr6j-2vh6
nvd.nist.gov/vuln/detail/CVE-2026-33050

Code Behaviors & Features

Detect and mitigate CVE-2026-33050 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →