CVE-2026-111211

EUVD-2026-116019

03.11.2026, 16:17

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
DSF	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
djangoproject	django	6.1 ≤ 𝑥 < 6.1.3	CNA
djangoproject	django	6.0 ≤ 𝑥 < 6.0.10	CNA
djangoproject	django	5.2 ≤ 𝑥 < 5.2.19	CNA

Debian Releases

Debian Product

Codename

python-django

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable
trixie (security)	vulnerable

Common Weakness Enumeration

CWE-117 - Improper Output Neutralization for Logs
The software does not neutralize or incorrectly neutralizes output that is written to logs.

References

https://docs.djangoproject.com/en/dev/releases/security/

https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374

https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba

https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793

https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a

https://groups.google.com/g/django-announce

https://www.djangoproject.com/weblog/2026/nov/03/security-releases/