CVE-2026-73976

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73976
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73976.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73976
Aliases
  • GHSA-7gp2-rxw9-vw6p
Published
2026-10-01T17:08:11Z
Modified
2026-10-02T03:47:47Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
djehuty: Unauthenticated SPARQL injection in the search API (`order`, `operator`, `key`)
Details

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read (SELECT) queries, this does not write to the store, but it allows: Cross-graph data exfiltration — e.g. UNION-ing in triples from graphs the request was never scoped to (drafts/private/internal data held in the RDF store); denial of service — expensive or malformed queries that tie up the SPARQL backend / web workers. No account or user interaction is required. This issue has been patched in version 26.3.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-943"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73976.json"
}
References

Affected packages

Git / github.com/4turesearchdata/djehuty

Affected ranges

Type
GIT
Repo
https://github.com/4turesearchdata/djehuty
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f40fe003febc9c164798bf2f6330cabd7896a662
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "26.3.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
production
user-testing-1
user-testing-2
user-testing-3
user-testing-4
v24.*
v24.1
v24.10
v24.10.1
v24.11
v24.12
v24.2
v24.3
v24.4
v24.5
v24.6
v24.7
v24.8
v24.9
v25.*
v25.1
v25.2
v25.3
v25.4
v25.5
v25.6
v26.*
v26.3
v26.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73976.json"