CVE-2026-111211
Medium · 5.3CVSS
5.3
EPSS
0.5%
Published
Nov 3, 2026
CISA due date
—
The record
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Aaron chen for reporting this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118994 CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login… CWE-117
- CVE-2026-119423 OPNsense core before 26.7.8 contains a log injection vulnerability that allows… CWE-117
- CVE-2026-15661 IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log… CWE-117
- CVE-2026-109786 In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter… CWE-117
- CVE-2026-87859 morgan is an HTTP request logger middleware for Node.js. CWE-117
- CVE-2026-14350 IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an… CWE-117
- CVE-2026-9736 IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to… CWE-117
- CVE-2026-15603 morgan is an HTTP request logger middleware for Node.js. CWE-117