8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69662

CVE-2025-69662: geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69662

CVE-2025-69662:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
geopandas	pip	< 1.1.2	1.1.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a SQL injection in the geopandas library when writing data to a PostGIS database. The root cause is the improper construction of a SQL query in the _write_postgis function, located in geopandas/io/sql.py. The geom_name parameter, which can be controlled by the user (as it represents the name of the geometry column in the GeoDataFrame), was directly interpolated into the SQL string for the Find_SRID function. This allowed for arbitrary SQL to be injected. The fix, as seen in commit 6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419, was to replace the unsafe f-string formatting with a parameterized query using SQLAlchemy's text and bindparams constructs. This ensures that the geom_name is treated as a literal string and not as executable SQL code. The public-facing API for this operation is the GeoDataFrame.to_postgis() method, which would be the entry point for an exploit and would appear in any runtime profile or stack trace when the vulnerability is triggered.

Vulnerable functions

_write_postgis

geopandas/io/sql.py

The `_write_postgis` function was vulnerable to SQL injection because it used an f-string to construct a SQL query with the `geom_name` parameter. An attacker could provide a specially crafted geometry column name to execute arbitrary SQL commands. The patch fixed this by using parameterized queries, which properly escape the input.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.