Log Injection in Django BaseGeometryWidget.deserialize (<6.1.3)
CVE-2026-111211 Published on November 3, 2026
Potential log injection via unescaped geometry form values
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.
`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.
Earlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.
Django would like to thank Aaron chen for reporting this issue.
Timeline
Initial report received.
Vulnerability confirmed. 14 days later.
Security release issued. 19 days later.
Weakness Type
Improper Output Neutralization for Logs
The software does not neutralize or incorrectly neutralizes output that is written to logs.
Products Associated with CVE-2026-111211
Want to know whenever a new CVE is published for Django Project Django? stack.watch will email you.
Affected Versions
djangoproject Django:- Version 6.1 and below 6.1.3 is affected.
- Version 6.1.3 is unaffected.
- Version 6.0 and below 6.0.10 is affected.
- Version 6.0.10 is unaffected.
- Version 5.2 and below 5.2.19 is affected.
- Version 5.2.19 is unaffected.