Fluid Attacks Database

Description

geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	python-geopandas	=1.0.1-2 \|\| =1.1.0-1~exp1 \|\| =1.1.1-1 \|\| =1.1.1-1~exp1 \|\| =1.1.1-2 \|\| =1.1.2-1 \|\| =1.1.2-2 \|\| =1.1.3-1 \|\| =1.1.3-2 \|\| =1.1.4-1	-
pypi	geopandas	>=0 <1.1.2	1.1.2
debian 11	python-geopandas	=0.8.2-1 \|\| >=0 <0.8.2-1+deb11u1	0.8.2-1+deb11u1
debian 12	python-geopandas	=0.12.2-1 \|\| =0.13.0-1~exp1 \|\| =0.13.2-1 \|\| =0.13.2-1~exp1 \|\| =0.13.2-2 \|\| =0.13.2-3 \|\| =0.14.0-1 \|\| =0.14.1-1 \|\| =0.14.2-1 \|\| =0.14.3-1 \|\| =0.14.3-2 \|\| =0.14.4-1 \|\| =1.0.1-1 \|\| =1.0.1-2 \|\| =1.1.0-1~exp1 \|\| =1.1.1-1 \|\| =1.1.1-1~exp1 \|\| =1.1.1-2 \|\| =1.1.2-1 \|\| =1.1.2-2 \|\| =1.1.3-1 \|\| =1.1.3-2 \|\| =1.1.4-1	-
debian 14	python-geopandas	=1.0.1-2 \|\| =1.1.0-1~exp1 \|\| =1.1.1-1 \|\| =1.1.1-1~exp1 \|\| =1.1.1-2 \|\| >=0 <1.1.2-1	1.1.2-1

Aliases

1. CVE-2025-696622. NVD-2025-696623. OSV-DEBIAN-2025-696624. OSV-2025-696625. GCVE-2025-696626. SECURITY-TRACKER-CVE-2025-696627. lists.debian.org

References

1. https://github.com/geopandas/geopandas/issues/36792. https://github.com/geopandas/geopandas/pull/36813. https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf4194. https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas5. https://github.com/geopandas/geopandas/releases/tag/v1.1.26. https://github.com/pypa/advisory-database/tree/main/vulns/geopandas/PYSEC-2026-62.yaml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.