djehuty: Authenticated SPARQL injection in session editing allows RDF triple writes
Summary
djehuty, a research data repository system, is affected by an SPARQL injection in the session name handling of the session edit function. An authenticated depositor can supply a crafted session name that breaks out of a SPARQL string literal and writes or deletes arbitrary triples in the shared RDF store. This compromises the integrity of the metadata of the whole repository, not only of the attacker's own records. A logged-in account is required, and self-registration via ORCID or SAML makes this a low barrier in typical deployments.
Affected
- djehuty versions before 26.3.2 (CNA data: affected < 26.3.2)
- Vulnerable endpoint: PUT /my/sessions/<uuid>/edit
Fixed in
- Fixed in djehuty 26.3.2
Workaround
- Unknown.
- Interim measure (not from the vendor): restrict self-registration or account creation until the update is applied, and check the RDF store for unexpected changes to session or dataset metadata.
Exploitation
- Not listed in the CISA KEV catalog; no known active exploitation.
- No public proof of concept confirmed in the sources; the vendor advisory includes a proof-of-concept request.
- CISA SSVC: exploitation status poc, not automatable.
Our recommendation
- If no djehuty instance is operated, no action is needed beyond monitoring.
- If an instance is operated, update to version 26.3.2 or later.
- Also update for the related CVE-2026-73976 (unauthenticated SPARQL injection in the search API), which is fixed in the same release.
- Review accounts with self-registration and check the RDF store for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9864-23x8-762h github.com
- djehuty release v26.3.2 github.com
- VulnCheck/Vulnrichment CVE-2026-73975 vulners.com
- HOL Guard CVE-2026-73975 hol.org
- Strix CVE-2026-73975 www.strix.ai
- OpenCVE CVE-2026-73975 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:57.
Original description (NVD)
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying (DELETE/INSERT) query by supplying a crafted session name, letting them write (and delete) arbitrary triples anywhere in the RDF store. Because the RDF store is shared across all accounts and datasets, this is an integrity compromise of the whole repository's metadata, not just the attacker's own records. Having a logged-in account is a precondition. djehuty allows self-registration via ORCID/SAML, so this is a low barrier in typical deployments. This issue has been patched in version 26.3.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.