---
id: CVE-2024-27091
aliases:
  - GHSA-rwcv-whm8-fmxm
title: 'GeoNode: Stored XSS to full account takeover'
summary: 'GeoNode: Stored XSS to full account takeover'
severity: medium
cvss: 6.1
cwe:
  - CWE-79
vendor: geonode
product: geonode
ecosystem: pip
affected:
  - 'geonode >= 3.2.1, < 4.2.3'
patched:
  - geonode 4.2.3
published: '2026-07-13'
updated: '2026-07-13'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-rwcv-whm8-fmxm'
references:
  - url: 'https://github.com/GeoNode/geonode/security/advisories/GHSA-rwcv-whm8-fmxm'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-27091'
  - url: >-
      https://github.com/GeoNode/geonode/commit/e53bdeff331f4b577918927d60477d4b50cca02f
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/geonode/PYSEC-2024-320.yaml
  - url: 'https://github.com/advisories/GHSA-rwcv-whm8-fmxm'
tags:
  - ghsa
  - pip
epss: 0.00379
epssPercentile: 0.2922
ingestedAt: '2026-07-13T17:27:59.107Z'
---

## Overview

An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed.

## Affected packages

- `geonode >= 3.2.1, < 4.2.3`

## Remediation

Upgrade to a patched release:

- `geonode 4.2.3`