CVE-2025-69662

HighPublic PoC

Published: 30 January 2026

Published

30 January 2026

Modified

21 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0039 30.2th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-69662 is a high-severity SQL Injection (CWE-89) vulnerability in Geopandas Geopandas. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-69662 is a SQL injection vulnerability (CWE-89) affecting geopandas versions prior to 1.1.2. The flaw resides in the to_postgis() function, which is used to write GeoDataFrames to a PostgreSQL database, enabling attackers to obtain sensitive information. The vulnerability carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, cross-scope impact, and high confidentiality consequences.

Any unauthenticated attacker with network access to a vulnerable geopandas installation can exploit this issue by crafting malicious input to the to_postgis() function during GeoDataFrame writes to PostgreSQL. Successful exploitation allows extraction of sensitive data from the target database without affecting integrity or availability.

Mitigation involves updating to geopandas version 1.1.2 or later, as detailed in the project's GitHub pull request at https://github.com/geopandas/geopandas/pull/3681. Additional guidance appears in the security advisory at https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas/ and Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-206572

Vulnerability details

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection in network-accessible to_postgis() directly enables T1190 exploitation of a public-facing app for DB access and T1213.006 collection from databases.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0