Description

DSpace open source software is a repository application which provides durable access to digital resources. From versions 8.0-rc1 to before 8.4, versions 9.0-rc1 to before 9.3, and version 10-rc1, Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This issue has been patched in versions 8.4, 9.3, and 10.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-02T18:19:32.830Z",
  "pubdate": "2026-09-02T18:19:32.830Z",
  "executiveSummary": "DSpace is susceptible to a Remote Code Execution (RCE) vulnerability stemming from the insecure processing of Velocity Templates within its COAR Notify/LDN messaging functionality.\nThis vulnerability allows an unauthenticated or remote attacker to inject malicious expressions into template processing engines, leading to the execution of arbitrary commands on the underlying host operating system.\nThe scope of impact is severe, as successful exploitation grants the attacker full control over the DSpace repository application and the potential to compromise the host environment.\nAffected versions include 8.0-rc1 through 8.3, 9.0-rc1 through 9.2, and 10-rc1. DSpace instances utilizing COAR Notify or Linked Data Notifications (LDN) are at high risk.\nRemediation requires upgrading to the patched versions 8.4, 9.3, or 10.0 immediately.",
  "technicalDetails": "The vulnerability originates from the improper handling and dynamic evaluation of Velocity Templates during the processing of COAR Notify and Linked Data Notification (LDN) messages.\nIn the DSpace architecture, Velocity is utilized to generate notification content dynamically. If the application environment does not adequately sanitize or restrict the input provided to the Velocity template engine, an attacker can supply malicious directives, such as Server-Side Template Injection (SSTI) payloads.\nThe exploitation flow begins with the delivery of a crafted COAR Notify or LDN message to the DSpace endpoint responsible for processing these requests. Because these protocols are designed to facilitate inter-repository communication, they often bypass traditional perimeter authentication mechanisms, exposing the template engine to external payloads.\nWhen the DSpace application parses the incoming message, the malicious Velocity syntax is evaluated by the engine. By invoking Java objects via Velocity's introspection capabilities, an attacker can access sensitive system classes, such as 'java.lang.Runtime' or 'java.lang.ProcessBuilder'.\nA typical attack payload would involve constructing an OGNL or Velocity expression that triggers a shell command execution. Once the expression is executed, the application interprets the malicious directive, forcing the host process to spawn a child process or execute system commands with the privileges of the DSpace service user.\nThe affected versions include 8.0-rc1 through 8.3, 9.0-rc1 through 9.2, and 10-rc1. The vulnerability is fundamentally a failure to isolate user-supplied message data from the templating logic, essentially treating untrusted input as executable code.\nPost-exploitation impact includes full system compromise, data exfiltration, lateral movement within the network, and the potential for persistent backdoors. Because the vulnerability lies within the template processing logic for notification messages, network-exposed instances are particularly susceptible to automated exploitation attempts targeting these specific protocol endpoints."
}