CVE-2026-55649 MEDIUM

CVE-2026-55649: GeoNode has Stored XSS in Documents metadata abstract field

Vendor Geonode

Product geonode

Weakness CWE-79 · XSS

Published November 6, 2026

Last update November 6, 2026

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.

Key dates

02Disclosure timeline

November 6, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-55649 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

04Related CVE

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 CVE-2026-18488 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) CVE-2026-7877 WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode CVE-2026-78293 WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-78281 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability