invenio-rdm-records

DataCite-based data model for InvenioRDM flavour.

View on Pypi

View on Github

Activity

Latest release: 5d ago
Total releases: 571
Cadence: ~3 days
Last 12 months: 80

Reach

Stars: 23

Details

License: MIT
First release: Oct 08, 2019

Releases

Version	Released
`32.3.1` patch	Sep 08, 2026
`32.3.0` minor	Sep 04, 2026
`35.0.2` patch	Aug 28, 2026
`35.0.1` patch	Aug 27, 2026
`32.2.2` patch	Aug 27, 2026
`32.2.1` patch	Aug 17, 2026
`35.0.0` major	Aug 13, 2026
`34.1.0` minor	Aug 13, 2026
`34.0.1` patch	Aug 04, 2026
`32.2.0` minor	Jul 31, 2026
`32.1.0` minor	Jul 28, 2026
`32.0.7` patch	Jul 27, 2026
`32.0.6` patch	Jul 23, 2026
`32.0.5` patch	Jul 21, 2026
`34.0.0` major	Jul 21, 2026
`32.0.4` patch	Jul 20, 2026
`33.3.0` minor	Jul 17, 2026
`32.0.3` patch	Jul 10, 2026
`20.3.1` patch	Jul 09, 2026
`32.0.2` patch	Jul 09, 2026
`33.2.0` minor	Jul 09, 2026
`33.1.0` minor	Jul 01, 2026
`33.0.0` major	Jun 18, 2026
`32.0.1` patch	Jun 12, 2026
`32.0.0` major	Jun 12, 2026
`31.0.0` major	Jun 05, 2026
`30.0.0` major	Jun 05, 2026
`29.0.0` major	May 29, 2026
`28.6.1` patch	May 06, 2026
`28.6.0` minor	May 06, 2026
`28.5.0` minor	Apr 21, 2026
`28.4.0` minor	Apr 21, 2026
`20.3.0` minor	Apr 16, 2026
`28.3.1` patch	Apr 14, 2026
`28.3.0` minor	Apr 13, 2026
`28.2.0` minor	Apr 09, 2026
`28.1.0` minor	Apr 09, 2026
`28.0.0` major	Apr 08, 2026
`20.2.1` patch	Mar 24, 2026
`22.7.4` patch	Mar 23, 2026
`27.0.0` major	Mar 20, 2026
`26.0.0` major	Mar 18, 2026
`25.0.0` major	Mar 10, 2026
`23.2.3` patch	Mar 02, 2026
`24.1.1` patch	Feb 27, 2026
`24.1.0` minor	Feb 17, 2026
`24.0.0` major	Feb 03, 2026
`22.7.3` patch	Jan 29, 2026
`22.7.2` patch	Jan 29, 2026
`23.2.2` patch	Jan 27, 2026

1–50 of 571

Repository

inveniosoftware/invenio-rdm-records

Forks: 122
Open issues: 119
Language: Python

Dependencies (40)

Depends on

32.3.1

Used by

Supply-chain exposure

29 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2021-43781 GHSA-xr38-w74q-r8jv PYSEC-2021-836 PYSEC-2021-837 PYSEC-2021-838 Dec 06, 2021

Permissions not properly checked in Invenio-Drafts-Resources

Medium
Network Low Low

Impact

Invenio-Drafts-Resources does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. cannot change a record from restricted to public.

Details

The service's publish() method contains the following permission check:

def publish(..): self.require_permission(identity, "publish")

However, the record should have been passed into the permission check so that the need generators have access to e.g. the record owner.

def publish(..): self.require_permission(identity, "publish", record=record)

The bug is activated in Invenio-RDM-Records which has a need generator called RecordOwners(), which when no record is passed in defaults to allow any authenticated user:

class RecordOwners(Generator): def needs(self, record=None, **kwargs): if record is None: return [authenticated_user] # ...

Patches

The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6+, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

You can verify the version installed of Invenio-Drafts-Resources via PIP:

cd ~/src/my-site pipenv run pip freeze | grep invenio-drafts-resources

References

Security policy

For more information

If you have any questions or comments about this advisory:

Chat with us on Discord: https://discord.gg/8qatqBC

Affected versions

0.10.00.10.10.11.00.11.10.12.00.13.00.13.10.13.20.13.30.13.40.14.00.14.1

+ 147 more Show less

0.15.00.16.00.17.00.17.10.18.00.18.10.18.20.18.30.19.00.19.10.20.00.20.10.20.20.20.30.20.40.20.60.20.70.20.80.21.00.22.00.22.10.23.00.23.10.23.100.23.20.23.30.23.40.23.50.23.60.23.70.23.80.23.90.24.10.24.20.24.30.24.40.24.50.24.60.25.00.25.10.25.20.25.30.25.40.25.50.25.60.25.70.25.80.25.90.26.00.26.10.26.20.26.30.26.40.26.50.26.60.27.00.27.10.27.100.27.110.27.120.27.130.27.140.27.150.27.20.27.30.27.40.27.50.27.60.27.70.27.80.27.90.28.00.28.10.28.100.28.110.28.120.28.20.28.30.28.40.28.50.28.60.28.70.28.80.28.90.29.00.29.10.29.100.29.110.29.120.29.130.29.140.29.150.29.160.29.170.29.20.29.30.29.40.29.60.29.70.29.80.29.90.30.00.30.10.30.20.30.30.30.40.30.50.30.60.30.70.30.80.30.90.31.00.31.10.31.100.31.110.31.120.31.130.31.140.31.150.31.160.31.170.31.180.31.20.31.30.31.40.31.50.31.60.31.70.31.80.31.90.32.00.32.10.32.20.32.30.32.40.32.50.9.00.33.00.33.10.33.20.33.30.33.40.33.50.33.60.33.70.33.80.33.9

Fixed in

0.32.60.33.10

References

https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jv
https://nvd.nist.gov/vuln/detail/CVE-2021-43781
https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626
https://github.com/pypa/advisory-database/tree/main/vulns/invenio-app-rdm/PYSEC-2021-837.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/invenio-drafts-resources/PYSEC-2021-836.yaml

Updated Jul 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 35
minor 189
patch 336
pre 10

571 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More