PyPI/geopandas CVE-2025-69662: high 8.6, EPSS 0.44%

geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

Action: Upgrade geopandas to 1.1.2 or later.

pip install geopandas==1.1.2

Affected

Fixed versions

Sources

• osv: GHSA-6497-prx7-gpmq
• https://nvd.nist.gov/vuln/detail/CVE-2025-69662
• https://github.com/geopandas/geopandas/issues/3679
• https://github.com/geopandas/geopandas/pull/3681
• https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419
• https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas
• https://github.com/geopandas/geopandas
• https://github.com/geopandas/geopandas/releases/tag/v1.1.2
• https://github.com/pypa/advisory-database/tree/main/vulns/geopandas/PYSEC-2026-62.yaml
• https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html

CVE-2025-69662 · published 2026-01-30T21:30:22Z · modified 2026-06-05T18:00:13.818427216Z · JSON