{"id":"CVE-2026-111211","summary":"Potential log injection via unescaped geometry form values","details":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.","modified":"2026-11-07T02:48:33.636019087Z","published":"2026-11-03T15:41:58.889Z","database_specific":{"cna_assigner":"DSF","cwe_ids":["CWE-117"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111211.json"},"references":[{"type":"WEB","url":"https://github.com/django/django/"},{"type":"ADVISORY","url":"https://docs.djangoproject.com/en/dev/releases/security/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111211.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111211"},{"type":"ADVISORY","url":"https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"},{"type":"FIX","url":"https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374"},{"type":"FIX","url":"https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba"},{"type":"FIX","url":"https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793"},{"type":"FIX","url":"https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a"},{"type":"PACKAGE","url":"https://pypi.org/project/Django/"},{"type":"ARTICLE","url":"https://groups.google.com/g/django-announce"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/django/django","events":[{"introduced":"fe0a859f537d4238cf49fca39073513206f83122"},{"fixed":"f16e25dcb9fe55734ba4ea2b00ac34405b7df74a"},{"introduced":"36b5f39d9372147f0e758f590e35ee2b2bc317dd"},{"fixed":"318369218fd7526226ae59fdc87108931520f2bc"},{"introduced":"9e7cc2b628fe8fd3895986af9b7fc9525034c1b0"},{"fixed":"060cd4ad20b532a8ba0a446130bebead23cba671"},{"fixed":"af4319f7217e33ad5db747226765f09b49ec07ba"},{"fixed":"b336d9a4e8a919d2e5f979b663de2b27e245b793"},{"fixed":"1b747694d6a68a6b5d48cbe81c71053092a5d374"},{"fixed":"b83bf870ee0006ab0dd84a01d1f3b0391320a51a"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"6.1"},{"fixed":"6.1.3"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"strategy":"StandardRange","range":[{"introduced":"6.0"},{"fixed":"6.0.10"}],"source":"AFFECTED_FIELD"},{"strategy":"StandardRange","range":[{"introduced":"5.2"},{"fixed":"5.2.19"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"af4319f7217e33ad5db747226765f09b49ec07ba"}]},{"range":[{"fixed":"b336d9a4e8a919d2e5f979b663de2b27e245b793"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"1b747694d6a68a6b5d48cbe81c71053092a5d374"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"b83bf870ee0006ab0dd84a01d1f3b0391320a51a"}]}]}}],"versions":["5.2.18","6.0.9","6.1.2","6.1.1","6.1","5.2.17","6.0.8","5.2.16","6.0.7","5.2.15","6.0.6","5.2.14","6.0.5","5.2.13","6.0.4","5.2.12","6.0.3","5.2.11","6.0.2","6.0.1","5.2.10","6.0","5.2.9","5.2.8","5.2.7","5.2.6","5.2.5","5.2.4","5.2.3","5.2.2","5.2.1","5.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-111211.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}