{"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-111211.json"},"ecosystem_specific":{},"package":{"ecosystem":"Alpine:v3.24","name":"py3-django","purl":"pkg:apk/alpine/py3-django?arch=source"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.2.19-r0"}],"type":"ECOSYSTEM"}]}],"details":"An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19.\n`django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize()`, used by `django.contrib.gis.forms.GeometryField`, does not escape invalid submitted values before logging them, which allows remote attackers to inject or forge log entries via a crafted geometry value.\nEarlier, unsupported Django series (such as 5.1.x, 5.0.x, and 4.2.x) were not evaluated and may also be affected.\nDjango would like to thank Aaron chen for reporting this issue.","id":"ALPINE-CVE-2026-111211","modified":"2026-11-04T09:30:02.883454841Z","published":"2026-11-03T16:17:18.720Z","references":[{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2026-111211"}],"schema_version":"1.9.2","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","type":"CVSS_V4"}],"upstream":["CVE-2026-111211"]}