---
id: CVE-2019-1020019
aliases:
  - GHSA-j9m2-6hq2-4r3c
  - PYSEC-2019-26
title: Cross-site Scripting in invenio-previewer
summary: Cross-site Scripting in invenio-previewer
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: invenio-previewer
product: invenio-previewer
ecosystem: pip
affected:
  - invenio-previewer < 1.0.0a12
patched:
  - invenio-previewer 1.0.0a12
published: '2019-07-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:47:55.087537191Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-j9m2-6hq2-4r3c'
references:
  - url: >-
      https://github.com/inveniosoftware/invenio-previewer/security/advisories/GHSA-j9m2-6hq2-4r3c
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-1020019'
  - url: 'https://github.com/advisories/GHSA-j9m2-6hq2-4r3c'
  - url: 'https://github.com/inveniosoftware/invenio-previewer'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/invenio-previewer/PYSEC-2019-26.yaml
tags:
  - osv
  - pip
epss: 0.00899
epssPercentile: 0.57938
ingestedAt: '2026-09-12T03:13:01.704Z'
---

## Overview

## Cross-Site Scripting (XSS) vulnerability in JSON, Markdown and iPython Notebook previewers

### Impact
Several Cross-Site Scripting (XSS) vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or Notebook file with embedded scripts that would be executed by a victims browser.

### Patches
Invenio-Previewer v1.0.0a12 fixes the issue.

### Workarounds
You can remediate the vulnerability without upgrading by disabling the affected previewers. You do this by adding the following to your configuration:

```python
PREVIEWER_PREFERENCE = [
    'csv_dthreejs',
    'simple_image',
    # 'json_prismjs',
    'xml_prismjs',
    # 'mistune',
    'pdfjs',
    # 'ipynb',
    'zip',
]
```

Afterwards, you should not be able to preview JSON, Markdown or iPython Notebook files.

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)

## Affected packages

- `invenio-previewer < 1.0.0a12`

## Remediation

Upgrade to a patched release:

- `invenio-previewer 1.0.0a12`