CVE-2019-1020003
Cross-site scripting invenio-records
invenio-records before 1.2.2 allows XSS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
invenio-records before 1.2.2 allows XSS.
- Record
CVE-2019-1020003- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
invenio-records before 1.2.2 allows XSS.
- Record
CVE-2019-1020003- Updated
- 2026-11-02
EUVDEUVD-2019-0064 No score
invenio-records before 1.2.2 allows XSS.
- Record
EUVD-2019-0064- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vxh3-mvv7-265j
Cross-site scripting invenio-records
Cross-Site Scripting (XSS) vulnerability in administration interface
Impact
A Cross-Site Scripting (XSS) vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an admin user would then later view in the admin interface.
Patches
All supported versions of Invenio-Records have been patched. You should upgrade to either v1.0.1, v1.1.1 or v1.2.2
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-vxh3-mvv7-265j- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
invenio-records before 1.2.2 allows XSS.
- Record
CVE-2019-1020003- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-vxh3-mvv7-265j
Cross-site scripting invenio-records
Cross-Site Scripting (XSS) vulnerability in administration interface
Impact
A Cross-Site Scripting (XSS) vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an admin user would then later view in the admin interface.
Patches
All supported versions of Invenio-Records have been patched. You should upgrade to either v1.0.1, v1.1.1 or v1.2.2
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-vxh3-mvv7-265j- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2019-27 No score
invenio-records before 1.2.2 allows XSS.
- Record
PYSEC-2019-27- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
invenio-recordsPyPI |
before 1.0.2 | 1.0.2 |
invenio-recordsPyPI |
1.1.0 to 1.1.0 | 1.1.1 |
invenio-recordsPyPI |
1.2.0 up to 1.2.2 | 1.2.2 |
invenio-recordsPyPI |
before 1.0.2, plus listed versions 0.1.00.2.00.2.10.3.00.3.1 Show 26 moreShow less0.3.20.3.30.3.40.3.4.post11.0.01.0.0a11.0.0a101.0.0a111.0.0a121.0.0a141.0.0a151.0.0a161.0.0a171.0.0a21.0.0a31.0.0a41.0.0a51.0.0a61.0.0a71.0.0a81.0.0a91.0.0b11.0.0b21.0.0b31.0.0b41.0.1 |
1.0.2 |
invenio-recordsPyPI |
1.1.0 up to 1.1.1 | 1.1.1 |
invenio-recordsPyPI |
1.2.0 up to 1.2.2, plus listed versions 1.2.1 |
1.2.2 |
invenio-recordsPyPI |
before 1.0.2, plus listed versions 0.1.00.2.00.2.10.3.00.3.1 Show 26 moreShow less0.3.20.3.30.3.40.3.4.post11.0.0a11.0.0a21.0.0a31.0.0a41.0.0a51.0.0a61.0.0a71.0.0a81.0.0a91.0.0a101.0.0a111.0.0a121.0.0a141.0.0a151.0.0a161.0.0a171.0.0b11.0.0b21.0.0b31.0.0b41.0.01.0.1 |
1.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1020003 is a medium vulnerability (CVSS 5.4) in Invenio Invenio-records, published July 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in invenio-records 1.0.2.