geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

HOCH 8.6CVE-2025-69662 · GHSA-6497-prx7-gpmq · PYSEC-2026-62 · Published 30/01/2026 · updated 17/06/2026

Kurz gesagt

CVE-2025-69662 ist eine Schwachstelle (HOCH (CVSS 8.6)) in geopandas, geopandas (geopandas).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.43%, höher als bei 37.2% aller Schwachstellen.
Abhilfe: auf 1.1.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
geopandas PyPI	`< 1.1.2`	`1.1.2`
geopandas geopandas	`< 1.1.2`	`1.1.2`

Description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

NVD description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

References

nvd.nist.gov/vuln/detail/CVE-2025-69662 · ADVISORY
geopandas/geopandas · WEB
geopandas/geopandas#3681 · WEB
geopandas/geopandas commit 6aa8ef1 · WEB
aydinnyunus.github.io/2025/12/27/sql-injection-geopandas · WEB
geopandas/geopandas · PACKAGE
geopandas/geopandas release v1.1.2 · WEB
pypa/advisory-database · WEB
lists.debian.org/debian-lts-announce/2026/04/msg00025.html · WEB
aydinnyunus.github.io/2025/12/27/sql-injection-geopandas · Exploit
GitHub Advisory GHSA-6497-prx7-gpmq · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

geopandas

PyPI

< 1.1.2

1.1.2

geopandas

< 1.1.2

1.1.2

Description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

NVD description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.