---
id: CVE-2019-1020003
aliases:
  - GHSA-vxh3-mvv7-265j
  - PYSEC-2019-27
title: Cross-site scripting invenio-records
summary: Cross-site scripting invenio-records
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
vendor: invenio-records
product: invenio-records
ecosystem: pip
affected:
  - invenio-records < 1.0.2
  - 'invenio-records >= 1.1.0, < 1.1.1'
  - 'invenio-records >= 1.2.0, < 1.2.2'
patched:
  - invenio-records 1.0.2
  - invenio-records 1.1.1
  - invenio-records 1.2.2
published: '2019-07-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:48:24.344770070Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vxh3-mvv7-265j'
references:
  - url: >-
      https://github.com/inveniosoftware/invenio-records/security/advisories/GHSA-vxh3-mvv7-265j
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-1020003'
  - url: 'https://github.com/advisories/GHSA-vxh3-mvv7-265j'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/invenio-records/PYSEC-2019-27.yaml
tags:
  - osv
  - pip
epss: 0.00864
epssPercentile: 0.56603
ingestedAt: '2026-09-12T03:13:01.732Z'
---

## Overview

## Cross-Site Scripting (XSS) vulnerability in administration interface

### Impact
A Cross-Site Scripting (XSS) vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an admin user would then later view in the admin interface.

### Patches
All supported versions of Invenio-Records have been patched. You should upgrade to either v1.0.1, v1.1.1 or v1.2.2

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)

## Affected packages

- `invenio-records < 1.0.2`
- `invenio-records >= 1.1.0, < 1.1.1`
- `invenio-records >= 1.2.0, < 1.2.2`

## Remediation

Upgrade to a patched release:

- `invenio-records 1.0.2`
- `invenio-records 1.1.1`
- `invenio-records 1.2.2`