CVE-2026-73976
- Source
- https://cve.org/CVERecord?id=CVE-2026-73976
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73976.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-73976
- Aliases
-
- GHSA-7gp2-rxw9-vw6p
- Published
- 2026-10-01T17:08:11Z
- Modified
- 2026-10-28T02:30:39Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
- Details
-
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-943" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73976.json" }- References
Affected packages
Git / github.com/4turesearchdata/djehuty
Affected ranges
- Type
- GIT
- Repo
- https://github.com/4turesearchdata/djehuty
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "26.3.2" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "original_tag": "v26.3.2", "range": [ { "fixed": "f40fe003febc9c164798bf2f6330cabd7896a662" } ], "source": "REFERENCES_TAG" }, { "range": [ { "introduced": "4TU.ResearchData" }, { "fixed": "26.3.2" } ], "source": "DESCRIPTION" }, { "range": [ { "introduced": "0" }, { "fixed": "26.3.2" } ], "source": "DESCRIPTION" } ] }