# CVE-2024-27091: GeoNode stored XSS in rich text editor

Source: https://junglewise.ai/threats/cve-2024-27091-geonode-stored-xss-in-rich-text-editor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2024-27091 · Severity: medium · CVSS 6.1 · Published 2026-07-13

GeoNode, a platform for sharing geospatial data, contains a security flaw in its text editor. An attacker can use this to run malicious scripts in another user's browser, potentially allowing them to hijack accounts by changing the associated email address. This could lead to a total loss of control over user accounts and the data they manage.

Technologies: [geonode (PyPI)](https://junglewise.ai/threats/technologies/pypi-geonode). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-27091 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-27091 being exploited in the wild.

**How severe is CVE-2024-27091?** Medium severity, with a CVSS score of 6.1, published 13 July 2026.

**Which products and versions are affected?** geonode (PyPI) ECOSYSTEM:introduced=3.2.1,fixed=4.2.3.

**Is there a fix for CVE-2024-27091?** Yes. geonode (PyPI): upgrade to 4.2.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-27091 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2024-27091?** Check whether you run geonode (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- geonode (PyPI): upgrade to 4.2.3 or later

  ```sh
  pip install "geonode>=4.2.3"
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the GeoNode rich text editor due to improper neutralization of user-controllable input (CWE-79). Although application cookies are set with secure flags, an attacker can inject malicious scripts that, when viewed by a victim, retrieve the victim's CSRF token. The attacker can then use this token to issue an unauthorized request to change the victim's email address, leading to a full account takeover. The exploit is successful because script elements do not trigger CORS policy restrictions in this context. The issue is fixed in version 4.2.3.

## Affected products

- GeoNode GeoNode >= 3.2.1, < 4.2.3

## Identifiers

- CVE-2024-27091
- GHSA-rwcv-whm8-fmxm
- PYSEC-2024-320

## Timeline

- 2024-03-27: disclosed: Initial disclosure and NVD publication
- 2024-03-27: patched: Fix committed to repository
- 2026-07-13: advisory: GitHub Advisory published/updated

## References

- [https://api.github.com/users/ImThatT](https://api.github.com/users/ImThatT)
- [https://github.com/ImThatT](https://github.com/ImThatT)
- [https://api.github.com/users/ImThatT/gists%7B/gist_id%7D](https://api.github.com/users/ImThatT/gists%7B/gist_id%7D)
- [https://api.github.com/users/ImThatT/repos](https://api.github.com/users/ImThatT/repos)
- [https://avatars.githubusercontent.com/u/35967437?v=4](https://avatars.githubusercontent.com/u/35967437?v=4)
- [https://api.github.com/users/ImThatT/events%7B/privacy%7D](https://api.github.com/users/ImThatT/events%7B/privacy%7D)

## Related threats

- [GeoNode stored XSS in documents metadata abstract field](https://junglewise.ai/threats/cve-2026-55649-geonode-has-stored-xss-in-documents-metadata-abstract-field)
- [GeoNode unrestricted file upload in upload service](https://junglewise.ai/threats/cve-2026-46429-geonode-has-unrestricted-file-upload)
- [GeoNode OS command injection in uploaded file layer name](https://junglewise.ai/threats/cve-2026-33050-geonode-has-os-command-injection-via-uploaded-file-layer-name)
- [GeoNode SSRF in service registration endpoint](https://junglewise.ai/threats/cve-2026-39922-geonode-ssrf-in-service-registration-endpoint)
- [GeoNode SSRF in document upload via doc_url parameter](https://junglewise.ai/threats/cve-2026-39921-geonode-ssrf-in-document-upload-via-doc-url-parameter)