Junglewise Threat Intelligence

CVE-2025-69662: GeoPandas SQL injection in to_postgis function

CVE-2025-69662 · Severity: high · CVSS 8.6 · Published 2026-01-30

Vendors: PyPI.

Executive brief

GeoPandas, a popular Python library for working with geographic data, contains a security vulnerability in its database export functionality. An attacker could use specially crafted data names to trick the system into executing unauthorized database commands. This could allow an attacker to view sensitive information, modify database records, or potentially delete data from the connected PostgreSQL database.

Technical details

A SQL injection vulnerability exists in the `to_postgis()` function of GeoPandas due to improper neutralization of special elements in SQL commands (CWE-89). The root cause is the use of f-string interpolation for variables such as `schema_name`, `name`, and `geom_name` when calling the PostGIS `Find_SRID` function. An attacker can exploit this by providing a malicious geometry column name via `rename_geometry()`, which breaks out of the intended SQL string to execute arbitrary statements. This can be used for error-based SQL injection to leak database versions or sensitive table data. The vulnerability is fixed in version 1.1.2 by implementing parameterized queries using SQLAlchemy's `bindparams`.

Affected products

  • geopandas geopandas < 1.1.2

Timeline

  • 2025-11-26: disclosed: Vulnerability reported to maintainers via GitHub issue
  • 2025-12-14: patched: Fix merged into main branch
  • 2026-01-30: advisory: GitHub Advisory and CVE published

References