GeoNode – a platform for geospatial data – stores a document's abstract metadata without sanitization. In versions before 5.0.3, a low‑privileged remote user can inject arbitrary HTML and JavaScript, which is rendered when other users view the document’s detail page. The injected code runs inside the victim’s browser with their privileges, allowing session hijacking, credential theft, or malicious actions. This flaw maps to CWE‑79.

The vulnerability exists in GeoNode releases earlier than 5.0.3, including 5.0.2 and older. Any deployment that permits users to add or edit document abstracts is affected.

The CVSS score of 6.3 classifies the vulnerability as moderate. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires the ability to create or modify a document abstract; the attacker embeds malicious code that executes in a victim’s browser when the document is viewed. The attack is confined to the victim’s session and does not provide server‑side compromise.