AIKIDO-2026-973809

TL;DR

GeoDjango spatial lookups optimistically pass the right-hand-side value to the django.contrib.gis.gdal.GDALRaster constructor, including untrusted filter input such as a spatial-field query string on a Django admin changelist. A dict, or a str holding its JSON form, is opened in write mode regardless of the constructor's write=False default, so a file-backed GDAL driver can write an attacker-chosen name and contents; any other str is treated as a datasource and can trigger an outbound request through a GDAL virtual filesystem handler. Writing a file that the application later imports can lead to remote code execution. The fix disallows dict values and strings that are not valid GEOSGeometry inputs in spatial lookups.