Vendor
GeoNode versions prior to 5.1.0 are vulnerable to OS command injection via a malicious layer name in uploaded vector files, allowing authenticated attackers to achieve remote code execution.