CVE-2026-111211

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111211", "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "state": "PUBLISHED", "assignerShortName": "DSF", "dateReserved": "2026-10-15T18:11:48.987Z", "datePublished": "2026-11-03T15:41:58.889Z", "dateUpdated": "2026-11-03T17:50:48.947Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "shortName": "DSF", "dateUpdated": "2026-11-03T15:41:58.889Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-117", "description": "CWE-117: Improper Output Neutralization for Logs", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-93", "descriptions": [{"lang": "en", "value": "CAPEC-93: Log Injection-Tampering-Forging"}]}], "title": "Potential log injection via unescaped geometry form values", "metrics": [{"other": {"content": {"value": "low", "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels"}, "type": "Django severity rating"}}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.</p><p><code>django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()</code>, used by <code>django.contrib.gis.forms.GeometryField</code>, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.</p><p>Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.</p><p>Django would like to thank Aaron chen for reporting this issue.</p>"}]}], "affected": [{"collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected", "packageName": "django", "product": "Django", "repo": "https://github.com/django/django/", "vendor": "djangoproject", "versions": [{"status": "affected", "version": "6.1", "lessThan": "6.1.3", "versionType": "python"}, {"status": "unaffected", "version": "6.1.3", "versionType": "python"}, {"status": "affected", "version": "6.0", "lessThan": "6.0.10", "versionType": "python"}, {"status": "unaffected", "version": "6.0.10", "versionType": "python"}, {"status": "affected", "version": "5.2", "lessThan": "5.2.19", "versionType": "python"}, {"status": "unaffected", "version": "5.2.19", "versionType": "python"}]}], "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "name": "Django security archive", "tags": ["vendor-advisory"]}, {"url": "https://groups.google.com/g/django-announce", "name": "Django releases announcements", "tags": ["mailing-list"]}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a"}, {"url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/", "name": "Django security releases issued: 6.1.3, 6.0.10, and 5.2.19", "tags": ["vendor-advisory"]}], "credits": [{"lang": "en", "type": "reporter", "value": "Aaron chen"}, {"lang": "en", "type": "analyst", "value": "David Smith"}, {"lang": "en", "type": "analyst", "value": "Jake Howard"}, {"lang": "en", "type": "analyst", "value": "Jacob Walls"}, {"lang": "en", "type": "analyst", "value": "Natalia Bidart"}, {"lang": "en", "type": "remediation developer", "value": "David Smith"}, {"lang": "en", "type": "remediation reviewer", "value": "Jacob Walls"}, {"lang": "en", "type": "remediation reviewer", "value": "Natalia Bidart"}, {"lang": "en", "type": "remediation reviewer", "value": "Shai Berger"}, {"lang": "en", "type": "coordinator", "value": "Jacob Walls"}], "timeline": [{"lang": "en", "time": "2026-10-01T12:00:00.000Z", "value": "Initial report received."}, {"lang": "en", "time": "2026-10-15T12:00:00.000Z", "value": "Vulnerability confirmed."}, {"lang": "en", "time": "2026-11-03T09:30:00.000Z", "value": "Security release issued."}], "datePublic": "2026-11-03T09:30:00.000Z", "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T17:50:24.327532Z", "id": "CVE-2026-111211", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:50:48.947Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-111211", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T17:50:24.327532Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:50:37.727Z"}}], "cna": {"title": "Potential log injection via unescaped geometry form values", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Aaron chen"}, {"lang": "en", "type": "analyst", "value": "David Smith"}, {"lang": "en", "type": "analyst", "value": "Jake Howard"}, {"lang": "en", "type": "analyst", "value": "Jacob Walls"}, {"lang": "en", "type": "analyst", "value": "Natalia Bidart"}, {"lang": "en", "type": "remediation developer", "value": "David Smith"}, {"lang": "en", "type": "remediation reviewer", "value": "Jacob Walls"}, {"lang": "en", "type": "remediation reviewer", "value": "Natalia Bidart"}, {"lang": "en", "type": "remediation reviewer", "value": "Shai Berger"}, {"lang": "en", "type": "coordinator", "value": "Jacob Walls"}], "impacts": [{"capecId": "CAPEC-93", "descriptions": [{"lang": "en", "value": "CAPEC-93: Log Injection-Tampering-Forging"}]}], "metrics": [{"other": {"type": "Django severity rating", "content": {"value": "low", "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels"}}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "affected": [{"repo": "https://github.com/django/django/", "vendor": "djangoproject", "product": "Django", "versions": [{"status": "affected", "version": "6.1", "lessThan": "6.1.3", "versionType": "python"}, {"status": "unaffected", "version": "6.1.3", "versionType": "python"}, {"status": "affected", "version": "6.0", "lessThan": "6.0.10", "versionType": "python"}, {"status": "unaffected", "version": "6.0.10", "versionType": "python"}, {"status": "affected", "version": "5.2", "lessThan": "5.2.19", "versionType": "python"}, {"status": "unaffected", "version": "5.2.19", "versionType": "python"}], "packageName": "django", "collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-10-01T12:00:00.000Z", "value": "Initial report received."}, {"lang": "en", "time": "2026-10-15T12:00:00.000Z", "value": "Vulnerability confirmed."}, {"lang": "en", "time": "2026-11-03T09:30:00.000Z", "value": "Security release issued."}], "datePublic": "2026-11-03T09:30:00.000Z", "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "name": "Django security archive", "tags": ["vendor-advisory"]}, {"url": "https://groups.google.com/g/django-announce", "name": "Django releases announcements", "tags": ["mailing-list"]}, {"url": "https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a", "tags": ["patch"]}, {"url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/", "name": "Django security releases issued: 6.1.3, 6.0.10, and 5.2.19", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.</p><p><code>django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()</code>, used by <code>django.contrib.gis.forms.GeometryField</code>, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.</p><p>Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.</p><p>Django would like to thank Aaron chen for reporting this issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-117", "description": "CWE-117: Improper Output Neutralization for Logs"}]}], "providerMetadata": {"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "shortName": "DSF", "dateUpdated": "2026-11-03T15:41:58.889Z"}}}, "cveMetadata": {"cveId": "CVE-2026-111211", "state": "PUBLISHED", "dateUpdated": "2026-11-03T17:50:48.947Z", "dateReserved": "2026-10-15T18:11:48.987Z", "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "datePublished": "2026-11-03T15:41:58.889Z", "assignerShortName": "DSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected", "packageName": "django", "product": "Django", "repo": "https://github.com/django/django/", "vendor": "djangoproject", "versions": [{"lessThan": "6.1.3", "status": "affected", "version": "6.1", "versionType": "python"}, {"status": "unaffected", "version": "6.1.3", "versionType": "python"}, {"lessThan": "6.0.10", "status": "affected", "version": "6.0", "versionType": "python"}, {"status": "unaffected", "version": "6.0.10", "versionType": "python"}, {"lessThan": "5.2.19", "status": "affected", "version": "5.2", "versionType": "python"}, {"status": "unaffected", "version": "5.2.19", "versionType": "python"}]}], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue."}], "id": "CVE-2026-111211", "lastModified": "2026-11-03T18:17:50.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111211", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T17:50:24.327532Z", "version": "2.0.3"}}]}, "published": "2026-11-03T16:17:18.720", "references": [{"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://docs.djangoproject.com/en/dev/releases/security/"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://github.com/django/django/commit/1b747694d6a68a6b5d48cbe81c71053092a5d374"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://github.com/django/django/commit/af4319f7217e33ad5db747226765f09b49ec07ba"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://github.com/django/django/commit/b336d9a4e8a919d2e5f979b663de2b27e245b793"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://github.com/django/django/commit/b83bf870ee0006ab0dd84a01d1f3b0391320a51a"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://groups.google.com/g/django-announce"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "url": "https://www.djangoproject.com/weblog/2026/nov/03/security-releases/"}], "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-117"}], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1,6.1.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,6.0.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.2,5.2.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.19"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Django", "source": "cna", "vendor": "djangoproject"}, "product": "django", "vendor": "django_project"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1,6.1.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,6.0.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.2,5.2.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.19"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Django", "source": "cna", "vendor": "djangoproject"}, "product": "django", "vendor": "djangoproject"}], "created": "2026-11-03T16:45:13.732656+00:00", "updated": "2026-11-03T16:45:14.066148+00:00", "vendors": ["django_project", "django_project$PRODUCT$django", "djangoproject", "djangoproject$PRODUCT$django"]}