CVE-2026-55649: Stored Cross-Site Scripting in GeoNode Document Metadata Abstract Field

Vulnerability ID: CVE-2026-55649
CVSS Score: 6.3
Published: 2026-11-06

CVE-2026-55649 is a stored Cross-Site Scripting (XSS) vulnerability in GeoNode versions prior to 5.0.3. The flaw exists because document abstract metadata fields are ingested via the metadata management pipeline and stored in the backend database without HTML sanitization or input neutralization. An authenticated attacker with privileges to create or edit document metadata can inject arbitrary HTML and JavaScript payloads into these fields. When another user, such as an administrator, views the affected document page or catalog listing, the unencoded payload is rendered into the Document Object Model (DOM) and executes within the victim's browser session.

TL;DR

GeoNode versions prior to 5.0.3 fail to sanitize HTML and JavaScript input in document abstract metadata fields. Authenticated users with resource editing permissions can inject persistent XSS payloads that execute in the browser sessions of administrators or peers viewing the resource.

Technical Details

Vulnerability Type: Stored Cross-Site Scripting (CWE-79)
Affected Component: Metadata Manager (geonode/metadata/manager.py)
Attack Vector: Network (Authenticated Low-Privilege User)
CVSS v3.1 Score: 6.3 Medium (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N)
Impact: Arbitrary JavaScript execution, session hijacking, unauthorized API actions
Affected Versions: GeoNode < 5.0.3
Patched Version: GeoNode 5.0.3
CISA KEV Status: Not Listed

Affected Systems

GeoNode Geospatial Content Management System
GeoNode: < 5.0.3 (Fixed in: 5.0.3)

Code Analysis

Commit: 0803857

Introduce CleanupHandler in geonode/metadata/handlers/meta.py and integrate pre_deserialization sanitization hook across metadata manager and settings.

File: geonode/metadata/handlers/meta.py @@ -0,0 +1,102 @@ +class CleanupHandler(MetadataHandler): + _HTML_LIKE_PATTERN = re.compile(r"<\s*/?\s*[a-zA-Z][^>]*>") + _DANGEROUS_TAGS = ("script", "style", "noscript", "iframe", "object", "embed") + + @classmethod + def _sanitize_string(cls, value: str): + normalized = unescape(value) + if not cls._HTML_LIKE_PATTERN.search(normalized): + return value, False + + soup = BeautifulSoup(normalized, "html.parser") + for tag in soup(cls._DANGEROUS_TAGS): + tag.decompose() + + sanitized = soup.get_text() + return sanitized, sanitized != value

Commit: 730d8fa

Backport CleanupHandler invocation directly into update_schema_instance in geonode/metadata/manager.py for the 5.0.x branch.

File: geonode/metadata/manager.py @@ -133,6 +137,11 @@ def update_schema_instance(self, resource, request_obj, lang=None, partial=None) handler.load_deserialization_context(resource, schema, context)   errors = {} + context["errors"] = errors + + # backported code: from 5.1.x onward pre_deserialization() is called on all Handlers + cleanup_handler = CleanupHandler() + cleanup_handler.pre_deserialization(resource, schema, json_instance, partial, context)

Mitigation Strategies

Upgrade GeoNode to version 5.0.3 or later to enable pre-deserialization metadata sanitization via CleanupHandler.
Audit the PostgreSQL backend database (specifically the base_resourcebase table) for pre-existing HTML or JavaScript tags stored in resource abstracts prior to patching.
Enforce a strict Content Security Policy (CSP) header on the reverse proxy (e.g., NGINX or Apache) that disables 'unsafe-inline' scripts and restricts connect-src domains.
Deploy Web Application Firewall (WAF) rules to inspect JSON request bodies sent to metadata and resource API endpoints for HTML tag patterns and JavaScript event handlers.
Restrict document creation and metadata editing privileges to trusted user roles until the patch is applied.

Remediation Steps:

Update the GeoNode package to version 5.0.3 or later using pip (pip install --upgrade geonode>=5.0.3) or update the deployment's Docker image tag to 5.0.3.
Verify that geonode.metadata.handlers.meta.CleanupHandler is present in the codebase and active within geonode/metadata/manager.py.
Restart the GeoNode WSGI application server (e.g., Gunicorn or uWSGI) and any associated Celery worker processes.
Connect to the GeoNode PostgreSQL database and execute a query (SELECT id, title, abstract FROM base_resourcebase WHERE abstract ~* '<\s*/?\s*[a-zA-Z][^>]*>';) to locate any pre-existing unescaped HTML in resource abstracts.
Sanitize or remove any identified malicious database records manually or by triggering a metadata re-save through the patched MetadataManager.