CVE-2025-69662
2 advisories.
PyPI/geopandas CVE-2025-69662: high 8.6
geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure
Action: Upgrade geopandas to 1.1.2 or later.
pip install geopandas==1.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.2 | - |
Fixed versions
| 1.1.2 |
Sources
- osv: GHSA-6497-prx7-gpmq
- https://nvd.nist.gov/vuln/detail/CVE-2025-69662
- https://github.com/geopandas/geopandas/issues/3679
- https://github.com/geopandas/geopandas/pull/3681
- https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419
- https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas
- https://github.com/geopandas/geopandas
- https://github.com/geopandas/geopandas/releases/tag/v1.1.2
- https://github.com/pypa/advisory-database/tree/main/vulns/geopandas/PYSEC-2026-62.yaml
- https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html
CVE-2025-69662 · published · modified · JSON
PyPI/geopandas CVE-2025-69662: high 8.6
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
Action: Upgrade geopandas to 1.1.2 or later.
pip install geopandas==1.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.1.2 | - |
Fixed versions
| 1.1.2 |
Sources
- osv: PYSEC-2026-62
- https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html
- https://github.com/geopandas/geopandas/pull/3681
- https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas/
- https://github.com/advisories/GHSA-6497-prx7-gpmq
CVE-2025-69662 · published · modified · JSON