CVE-2026-55649: CVE-2026-55649: Stored Cross-Site Scripting in GeoNode Document Metadata Abstract Field

CVE-2026-55649: Stored Cross-Site Scripting in GeoNode Document Metadata Abstract Field Vulnerability ID: CVE-2026-55649 CVSS Score: 6.3 Published: 2026-11-06 CVE-2026-55649 is a stored Cross-Site Scripting (XSS) vulnerability in GeoNode versions prior to 5.0.3. The flaw exists because document abstract metadata fields are ingested via the metadata management pipeline and stored in the backend database without HTML sanitization or input neutralization. An authenticated attacker with privileges to create or edit document metadata can inject arbitrary HTML and JavaScript payloads into these fields. When another user, such as an administrator, views the affected document page or catalog listing, the unencoded payload is rendered into the Document Object Model (DOM) and executes within the victim's browser session. TL;DR GeoNode versions prior to 5.0.3 fail to sanitize HTML and JavaScript input in document abstract metadata fields. Authenticated users with resource editing permissions can inject persistent XSS payloads that execute in the browser sessions of administrators or peers viewing the resource. Technical Details Vulnerability Type: Stored Cross-Site Scripting (CWE-79) Affected Component: Metadata Manager (geonode/metadata/manager.py) Attack Vector: Network (Authenticated Low-Privilege User) CVSS v3.1 Score: 6.3 Medium (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N) Impact: Arbitrary JavaScript execution, session hijacking, unauthorized API actions Affected Versions: GeoNode < 5.0.3 Patched Version: GeoNode 5.0.3 CISA KEV Status: Not Listed Affected Systems GeoNode Geospatial Content Management System GeoNode: < 5.0.3 (Fixed in: 5.0.3) Code Analysis Commit: 0803857 Introduce CleanupHandler in geonode/metadata/handlers/meta.py and integrate pre_deserialization sanitization hook across metadata manager and settings. File: geonode/metadata/handlers/meta.py @@ -0,0 +1,102 @@ +class CleanupHandler(MetadataHandler): + _HTML_LIKE_PATTERN = re.compile(r"]*>") + _DANGEROUS_TAGS = ("script", "style", "noscript", "iframe", "object", "embed") + + @classmethod + def _sanitize_string(cls, value: str): + normalized = unescape(value) + if not cls._HTML_LIKE_PATTERN.search(normalized): + return value, False + + soup = BeautifulSoup(normalized, "html.parser") + for tag in soup(cls._DANGEROUS_TAGS): + tag.decompose() + + sanitized = soup.get_text() + return sanitized, sanitized != value Commit: 730d8fa Backport CleanupHandler invocation directly into update_schema_instance in geonode/metadata/manager.py for the 5.0.x branch. File: geonode/metadata/manager.py @@ -133,6 +137,11 @@ def update_schema_instance(self, resource, request_obj, lang=None, partial=None) handler.load_deserialization_context(resource, schema, context) errors = {} + context["errors"] = errors + + # backported code: from 5.1.x onward pre_deserialization() is called on all Handlers + cleanup_handler = CleanupHandler() + cleanup_handler.pre_deserialization(resource, schema, json_instance, partial, context) Mitigation Strategies Upgrade GeoNode to version 5.0.3 or later to enable pre-deserialization metadata sanitization via CleanupHandler. Audit the PostgreSQL backend database (specifically the base_resourcebase table) for pre-existing HTML or JavaScript tags stored in resource abstracts prior to patching. Enforce a strict Content Security Policy (CSP) header on the reverse proxy (e.g., NGINX or Apache) that disables 'unsafe-inline' scripts and restricts connect-src domains. Deploy Web Application Firewall (WAF) rules to inspect JSON request bodies sent to metadata and resource API endpoints for HTML tag patterns and JavaScript event handlers. Restrict document creation and metadata editing privileges to trusted user roles until the patch is applied. Remediation Steps: Update the GeoNode package to version 5.0.3 or later using pip (pip install --upgrade geonode>=5.0.3) or update the deployment's Docker image tag to 5.0.3. Verify that geonode.metadata.handlers.meta.CleanupHandler is present in the codebase and active within geonode/metadata/manager.py. Restart the GeoNode WSGI application server (e.g., Gunicorn or uWSGI) and any associated Celery worker processes. Connect to the GeoNode PostgreSQL database and execute a query (SELECT id, title, abstract FROM base_resourcebase WHERE abstract ~* ']*>';) to locate any pre-existing unescaped HTML in resource abstracts. Sanitize or remove any identified malicious database records manually or by triggering a metadata re-save through the patched MetadataManager. References GitHub Security Advisory: GHSA-r4hm-p9f9-fj9v Primary Patch Commit: 0803857b22eba5b55729145ef401b1bc1c23e332 Backport Patch Commit: 730d8fae206ea5b051f630718aeecae1bf7b5760 GeoNode Pull Request #14322 GeoNode Pull Request #14343 GeoNode Release 5.0.3 CVE.org Record: CVE-2026-55649 NVD Entry: CVE-2026-55649 Read the full report for CVE-2026-55649 on our website for more details including interactive diagrams and full exploit analysis.