CVE-2026-111211

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.3 Django versions prior to 6.0.10 Django versions prior to 5.2.19

Description The django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize() function, utilized by django.contrib.gis.forms.GeometryField, fails to escape invalid submitted values before they are logged. This allows remote attackers to inject or forge log entries by providing a specially crafted geometry value.

Recommendations Update to version 6.1.3 or later. Update to version 6.0.10 or later. Update to version 5.2.19 or later.