GeoNetwork (OSGeo geospatial metadata catalog used behind many government and agency geoportals) published advisories on 31 August 2026 for two flaws that chain to unauthenticated remote code execution.

CVE-2026-63219 (CVSS 8.6 per the project's GitHub advisory) is a missing authorisation check on the formatter upload endpoint that lets an anonymous attacker write arbitrary .xsl or .zip formatter files.

CVE-2026-58400 (CVSS 9.1 per the project's GitHub advisory) is an unsafe Saxon XSLT configuration in the formatter engine that can call Runtime.exec / ProcessBuilder as the GeoNetwork process user once a malicious stylesheet is loaded. Fixed in 4.4.12 and 4.2.17; all 4.4.x through 4.4.11 and 4.2.x through 4.2.16 are affected. Project mitigation until patched: block write methods to /geonetwork/srv/api/formatters at the reverse proxy.

The advisories credit Ethiack researchers as reporters. (sources: GitHub GHSA-mh22-prqr-vf42; GitHub GHSA-x898-729x-cc3r)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: GitHub GHSA-mh22-prqr-vf42; GitHub GHSA-x898-729x-cc3r)