CVE-2026-33050

Summary

A command injection vulnerability in GeoNode prior to 5.1.0 allows low-privileged remote users to execute arbitrary OS commands by injecting shell syntax through a crafted vector file layer name during upload. This occurs because user-supplied input is improperly sanitized before being used in shell command execution.

Exploitability

Exploitation requires only low-privileged authentication and no user interaction, with straightforward payload construction due to lack of input sanitization.

Blast radius

Successful exploitation grants full system compromise of the GeoNode server, enabling data exfiltration, lateral movement, or infrastructure disruption.

Detection

Defenders should monitor for unexpected shell command execution in application logs (e.g., lines containing 'sh', 'bash', 'cmd.exe', or system utilities like 'ls', 'cat' invoked via upload-related endpoints), especially when accompanied by non-standard layer names containing shell metacharacters such as ';', '|', '$(', or backticks.

Prioritized remediation

Upgrade GeoNode to version 5.1.0 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.