Is CVE-2024-27091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-27091 being exploited in the wild.

How severe is CVE-2024-27091?

Medium severity, with a CVSS score of 6.1, published 13 July 2026.

Which products and versions are affected?

geonode (PyPI) ECOSYSTEM:introduced=3.2.1,fixed=4.2.3.

Is there a fix for CVE-2024-27091?

Yes. geonode (PyPI): upgrade to 4.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-27091 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2024-27091?

Check whether you run geonode (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-27091: GeoNode stored XSS in rich text editor

CVE-2024-27091 · Severity: medium · CVSS 6.1 · Published 2026-07-13

GeoNode, a platform for sharing geospatial data, contains a security flaw in its text editor. An attacker can use this to run malicious scripts in another user's browser, potentially allowing them to hijack accounts by changing the associated email address. This could lead to a total loss of control over user accounts and the data they manage.

Technologies: geonode (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-27091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-27091 being exploited in the wild.
How severe is CVE-2024-27091?: Medium severity, with a CVSS score of 6.1, published 13 July 2026.
Which products and versions are affected?: geonode (PyPI) ECOSYSTEM:introduced=3.2.1,fixed=4.2.3.
Is there a fix for CVE-2024-27091?: Yes. geonode (PyPI): upgrade to 4.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-27091 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2024-27091?: Check whether you run geonode (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

geonode (PyPI): upgrade to 4.2.3 or later
```
pip install "geonode>=4.2.3"
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the GeoNode rich text editor due to improper neutralization of user-controllable input (CWE-79). Although application cookies are set with secure flags, an attacker can inject malicious scripts that, when viewed by a victim, retrieve the victim's CSRF token. The attacker can then use this token to issue an unauthorized request to change the victim's email address, leading to a full account takeover. The exploit is successful because script elements do not trigger CORS policy restrictions in this context. The issue is fixed in version 4.2.3.

Affected products

GeoNode GeoNode >= 3.2.1, < 4.2.3

Identifiers

CVE-2024-27091
GHSA-rwcv-whm8-fmxm
PYSEC-2024-320

Timeline

2024-03-27: disclosed: Initial disclosure and NVD publication
2024-03-27: patched: Fix committed to repository
2026-07-13: advisory: GitHub Advisory published/updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.