CVE-2026-111362
Server-side request forgery via crs member of GeoJSON geometries
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected destinations via crafted crs members. Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected. Django would like to thank Submersion Security Research Team for reporting this issue.
| CWE | CWE-918 |
| Vendor | djangoproject |
| Product | django |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for djangoproject django
Be the first to know when new medium vulnerabilities affecting djangoproject django are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
djangoproject / Django
6.1 < 6.1.3 6.0 < 6.0.10 5.2 < 5.2.19
References
docs.djangoproject.com: https://docs.djangoproject.com/en/dev/releases/security/ groups.google.com: https://groups.google.com/g/django-announce github.com: https://github.com/django/django/commit/ecb2b77b49890d6b2120f73fb3d7eb7ac7650143 github.com: https://github.com/django/django/commit/649fb7985f67d5936dfb8caae6a54c0870dc8eec github.com: https://github.com/django/django/commit/e938f676fcca72f41247b0e96d4f0805e1722913 github.com: https://github.com/django/django/commit/31bef742da017bc71fdce9298c30984aad844102 djangoproject.com: https://www.djangoproject.com/weblog/2026/nov/03/security-releases/
Credits
🔍 Submersion Security Research Team Ken Whitesell David Smith Jacob Walls Sarah Boyce Jacob Walls David Smith Sarah Boyce Jacob Walls