affected:
- package:
    ecosystem: PyPI
    name: geopandas
    purl: pkg:pypi/geopandas
  ranges:
  - events:
    - introduced: '0'
    - fixed: 1.1.2
    type: ECOSYSTEM
  versions:
  - 0.1.0
  - 0.1.0.dev-120828c
  - 0.1.0.dev-120d5ee
  - 0.1.0.dev-189a35c
  - 0.1.0.dev-1edddad
  - 0.1.0.dev-2be7de8
  - 0.1.0.dev-2d642e0
  - 0.1.0.dev-3ebcae0
  - 0.1.0.dev-40ec104
  - 0.1.0.dev-53f669a
  - 0.1.0.dev-6c816f0
  - 0.1.0.dev-7788a17
  - 0.1.0.dev-8144a45
  - 0.1.0.dev-a7b594e
  - 0.1.0.dev-a91e8ab
  - 0.1.0.dev-abb4137
  - 0.1.0.dev-c770a5c
  - 0.1.0.dev-fea5c40
  - 0.1.1
  - 0.10.0
  - 0.10.1
  - 0.10.2
  - 0.11.0
  - 0.11.1
  - 0.12.0
  - 0.12.1
  - 0.12.2
  - 0.13.0
  - 0.13.1
  - 0.13.2
  - 0.14.0
  - 0.14.1
  - 0.14.2
  - 0.14.3
  - 0.14.4
  - 0.1dev
  - '0.2'
  - 0.2.1
  - 0.3.0
  - 0.4.0
  - 0.4.1
  - 0.5.0
  - 0.5.1
  - 0.6.0
  - 0.6.0rc1
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.7.0
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.9.0
  - 1.0.0
  - 1.0.0a1
  - 1.0.0rc1
  - 1.0.1
  - 1.1.0
  - 1.1.1
aliases:
- CVE-2025-69662
- GHSA-6497-prx7-gpmq
details: SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker
  to obtain sensitive information via the to_postgis()` function being used to write
  GeoDataFrames to a PostgreSQL database.
id: PYSEC-2026-62
modified: '2026-05-20T09:19:01.303850Z'
published: '2026-01-30T19:16:11.967Z'
references:
- type: WEB
  url: https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html
- type: FIX
  url: https://github.com/geopandas/geopandas/pull/3681
- type: EVIDENCE
  url: https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas/
- type: ADVISORY
  url: https://github.com/advisories/GHSA-6497-prx7-gpmq
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
  type: CVSS_V3