Skip to content

[Aikido] Fix security issue in geopy via minor version upgrade from 2.0.0 to 2.5.0 - #1

Open
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-75820419-5qo5
Open

[Aikido] Fix security issue in geopy via minor version upgrade from 2.0.0 to 2.5.0#1
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-75820419-5qo5

Conversation

@aikido-autofix

@aikido-autofix aikido-autofix Bot commented Jul 28, 2026

Copy link
Copy Markdown

Upgrade geopy to fix ReDoS vulnerability in coordinate parsing that could cause DoS through catastrophic backtracking on malformed inputs.

✅ Code not affected by breaking changes.

✅ No breaking changes from the geopy upgrade (2.0.0 => 2.5.0) affect this codebase.

The codebase only uses the Nominatim geocoder with its reverse() method for converting coordinates to addresses. None of the removed or modified components (GoogleV3, GeocodeFarm, Algolia Places, or Point.from_string) are used in this project.

All breaking changes by upgrading geopy from version 2.0.0 to 2.5.0 (CHANGELOG)

Version Description
2.1.0
:class:.GoogleV3: change missing api_key warning to an error.
2.2.0
Removed GeocodeFarm class: the service is very unstable.
2.4.0
Removed Algolia Places geocoder: the service is shut down.
2.5.0
:meth:.Point.from_string rejects any inputs longer than 256 chars unconditionally, which may start falsely rejecting previously valid Point strings with long irrelevant prefixes.
✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
AIKIDO-2026-829845
LOW
[geopy] A regular expression in Point.from_string exhibits catastrophic backtracking on long, malformed inputs, allowing attackers to cause denial of service by hanging the process with excessive CPU consumption. The vulnerability is fixed by enforcing a 256-character input limit before regex processing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants