invenio-app-rdm

Turn-key research data management platform.

View on Pypi

View on Github

Activity

Latest release: 1w ago
Total releases: 546
Cadence: ~2 days
Last 12 months: 77

Reach

Stars: 176

Details

License: MIT
First release: Oct 31, 2019

Releases

Version	Released
`14.0.4` patch	Sep 03, 2026
`14.0.2` patch	Sep 01, 2026
`15.0.0b3.dev1` pre	Aug 31, 2026
`14.0.1` patch	Aug 26, 2026
`15.0.0b3.dev0` pre	Aug 13, 2026
`15.0.0b2.dev1` pre	Aug 13, 2026
`14.0.0` major	Aug 07, 2026
`14.0.0rc5` pre	Aug 06, 2026
`14.0.0rc4` pre	Jul 29, 2026
`14.0.0rc3` pre	Jul 28, 2026
`15.0.0b2.dev0` pre	Jul 21, 2026
`15.0.0b1.dev0` pre	Jul 10, 2026
`14.0.0rc2` pre	Jun 13, 2026
`15.0.0b0.dev0` pre	Jun 08, 2026
`14.0.0rc1` pre	Jun 08, 2026
`14.0.0b11.dev4` pre	Jun 05, 2026
`14.0.0b11.dev3` pre	Jun 05, 2026
`14.0.0b11.dev2` pre	Jun 03, 2026
`14.0.0b11.dev1` pre	May 29, 2026
`14.0.0b11.dev0` pre	May 29, 2026
`13.1.2` patch	May 01, 2026
`13.1.1` patch	May 01, 2026
`14.0.0b10.dev7` pre	Apr 21, 2026
`14.0.0b10.dev6` pre	Apr 13, 2026
`14.0.0b10.dev5` pre	Apr 09, 2026
`14.0.0b10.dev4` pre	Apr 09, 2026
`14.0.0b10.dev3` pre	Apr 09, 2026
`14.0.0b10.dev2` pre	Apr 09, 2026
`14.0.0b10.dev1` pre	Apr 09, 2026
`14.0.0b10.dev0` pre	Apr 08, 2026
`13.1.0` minor	Mar 27, 2026
`13.0.9` patch	Mar 27, 2026
`14.0.0b9.dev0` pre	Mar 23, 2026
`14.0.0b8.dev0` pre	Mar 20, 2026
`14.0.0b7.dev1` pre	Mar 19, 2026
`14.0.0b7.dev0` pre	Mar 18, 2026
`14.0.0b6.dev0` pre	Mar 11, 2026
`14.0.0b5.dev6` pre	Mar 03, 2026
`14.0.0b4.dev8` pre	Mar 02, 2026
`14.0.0b5.dev5` pre	Feb 27, 2026
`14.0.0b5.dev4` pre	Feb 23, 2026
`14.0.0b5.dev3` pre	Feb 17, 2026
`14.0.0b5.dev2` pre	Feb 13, 2026
`14.0.0b4.dev7` pre	Feb 05, 2026
`14.0.0b5.dev0` pre	Feb 03, 2026
`14.0.0b3.dev6` pre	Jan 29, 2026
`14.0.0b3.dev5` pre	Jan 29, 2026
`14.0.0b4.dev6` pre	Jan 22, 2026
`14.0.0b4.dev5` pre	Jan 21, 2026
`13.0.8` patch	Jan 16, 2026

1–50 of 546

Repository

inveniosoftware/invenio-app-rdm

Forks: 197
Open issues: 283
Language: JavaScript
: 5.4/ 10

Dependencies (44)

Depends on

14.0.4

Used by

Supply-chain exposure

20 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2021-43781 GHSA-xr38-w74q-r8jv PYSEC-2021-836 PYSEC-2021-837 PYSEC-2021-838 Dec 06, 2021

Permissions not properly checked in Invenio-Drafts-Resources

Medium
Network Low Low

Impact

Invenio-Drafts-Resources does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. cannot change a record from restricted to public.

Details

The service's publish() method contains the following permission check:

def publish(..): self.require_permission(identity, "publish")

However, the record should have been passed into the permission check so that the need generators have access to e.g. the record owner.

def publish(..): self.require_permission(identity, "publish", record=record)

The bug is activated in Invenio-RDM-Records which has a need generator called RecordOwners(), which when no record is passed in defaults to allow any authenticated user:

class RecordOwners(Generator): def needs(self, record=None, **kwargs): if record is None: return [authenticated_user] # ...

Patches

The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6+, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

You can verify the version installed of Invenio-Drafts-Resources via PIP:

cd ~/src/my-site pipenv run pip freeze | grep invenio-drafts-resources

References

Security policy

For more information

If you have any questions or comments about this advisory:

Chat with us on Discord: https://discord.gg/8qatqBC

Affected versions

0.10.00.10.10.11.00.11.10.11.20.12.00.12.10.12.20.12.30.12.40.12.50.13.0

+ 123 more Show less

0.14.00.14.10.14.20.14.30.14.40.14.50.14.60.14.70.14.80.15.00.16.00.16.10.16.20.16.30.16.40.16.50.16.60.17.00.17.10.17.20.17.30.17.40.18.00.18.20.18.30.18.40.18.50.18.60.18.70.18.80.19.00.19.10.19.20.19.30.19.40.19.50.19.60.19.70.19.80.19.90.20.00.20.10.20.100.20.110.20.20.20.30.20.40.20.50.20.60.20.70.20.80.20.90.6.00.6.10.6.20.6.30.7.00.8.00.8.10.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.81.0.01.0.0a21.0.0a31.0.0a41.0.0a52.0.02.0.0.dev02.0.0.dev12.0.0.dev22.0.0.dev32.0.0.dev42.0.13.0.03.0.0.dev03.0.0.dev13.0.0.dev23.0.0.dev33.0.0.dev43.0.0.dev53.0.0.dev63.0.0.dev73.0.0rc14.0.04.0.0.dev04.0.0.dev14.0.0.dev24.0.0.dev34.0.0.dev44.0.15.0.05.0.0.dev05.0.0.dev15.0.0.dev105.0.0.dev25.0.0.dev35.0.0.dev45.0.0.dev55.0.0.dev65.0.0.dev75.0.0.dev85.0.0.dev96.0.06.0.0.dev06.0.0.dev16.0.0.dev26.0.0.dev36.0.16.0.26.0.36.0.47.0.0.dev07.0.0.dev17.0.0.dev27.0.0.dev37.0.0.dev4

Fixed in

6.0.57.0.0.dev5

References

https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jv
https://nvd.nist.gov/vuln/detail/CVE-2021-43781
https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626
https://github.com/pypa/advisory-database/tree/main/vulns/invenio-app-rdm/PYSEC-2021-837.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/invenio-drafts-resources/PYSEC-2021-836.yaml

Updated Jul 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 14
minor 18
patch 126
pre 387

546 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More