CVE-2025-69662
Publication date 30 January 2026
Last updated 11 March 2026
Ubuntu priority
Description
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| python-geopandas | 25.10 questing |
Fixed 1.0.1-2ubuntu0.1
|
| 24.04 LTS noble |
Fixed 0.14.3-2ubuntu0.1
|
|
| 22.04 LTS jammy |
Fixed 0.10.2-1ubuntu0.1
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
8.6 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-8083-1
- GeoPandas vulnerability
- 11 March 2026