geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

ÉLEVÉE 8.6CVE-2025-69662 · GHSA-6497-prx7-gpmq · PYSEC-2026-62 · Published 30/01/2026 · updated 17/06/2026

En bref

CVE-2025-69662 est une vulnérabilité ÉLEVÉE (CVSS 8.6) touchant geopandas, geopandas (geopandas).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.43%, plus élevée que 37.2% des vulnérabilités.
Correctif : mettre à jour vers 1.1.2 ou plus récent.

Package	Affected versions	Patched versions
geopandas PyPI	`< 1.1.2`	`1.1.2`
geopandas geopandas	`< 1.1.2`	`1.1.2`

Description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

NVD description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

References

nvd.nist.gov/vuln/detail/CVE-2025-69662 · ADVISORY
geopandas/geopandas · WEB
geopandas/geopandas#3681 · WEB
geopandas/geopandas commit 6aa8ef1 · WEB
aydinnyunus.github.io/2025/12/27/sql-injection-geopandas · WEB
geopandas/geopandas · PACKAGE
geopandas/geopandas release v1.1.2 · WEB
pypa/advisory-database · WEB
lists.debian.org/debian-lts-announce/2026/04/msg00025.html · WEB
aydinnyunus.github.io/2025/12/27/sql-injection-geopandas · Exploit
GitHub Advisory GHSA-6497-prx7-gpmq · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

geopandas

PyPI

< 1.1.2

1.1.2

geopandas

< 1.1.2

1.1.2

Description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

NVD description

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.