Vulnerability · Published Nov 3, 2026 · Assigned by DSF
CVE-2026-111211Potential log injection via unescaped geometry form values
Medium 5.3
In plain English
A medium-severity security flaw in Django from djangoproject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | py3-django | 5.2.19-r0 | ALPINE-CVE-2026-111211 |
| Debian:12 | python-django | no fix listed | DEBIAN-CVE-2026-111211 |
| Debian:13 | python-django | no fix listed | DEBIAN-CVE-2026-111211 |
| Debian:14 | python-django | no fix listed | DEBIAN-CVE-2026-111211 |
| Ubuntu:22.04:LTS | python-django | no fix listed | UBUNTU-CVE-2026-111211 |
| Ubuntu:24.04:LTS | python-django | no fix listed | UBUNTU-CVE-2026-111211 |
| Ubuntu:26.04:LTS | python-django | no fix listed | UBUNTU-CVE-2026-111211 |
| Ubuntu:26.10 | python-django | no fix listed | UBUNTU-CVE-2026-111211 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| djangoproject | Django | 6.1 – before 6.1.36.0 – before 6.0.105.2 – before 5.2.19 |
Weakness: CWE-117 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- Django security archive vendor-advisory
- Django releases announcements mailing-list
- https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba patch
- https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793 patch
- https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374 patch
- https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a patch
- Django security releases issued: 6.1.3, 6.0.10, and 5.2.19 vendor-advisory