Geopython vulnerabilities
We track 3 vulnerabilities in Geopython products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 8, 2026.
Latest Geopython vulnerabilities
- 8.6 High severity
pygeoapi: Server-Side Request Forgery
pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in v
- 7.5 High severity
pygeoapi: Improper Limitation of a Pathname to a Restricted Directory
pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, a raw string path concatenation vulnerability in pygeoapi's STAC FileSystemProvider plugin can allow for requests to STAC collection bas
- 7.5 High severity
OWSLib: Improper Restriction of XML External Entity Reference
OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related content models. OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution, and