CVE-2019-1020019: Cross-site Scripting in invenio-previewer

July 16, 2019 (updated September 23, 2024)

Several Cross-Site Scripting (XSS) vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or Notebook file with embedded scripts that would be executed by a victims browser.

References

github.com/advisories/GHSA-j9m2-6hq2-4r3c
github.com/inveniosoftware/invenio-previewer
github.com/inveniosoftware/invenio-previewer/security/advisories/GHSA-j9m2-6hq2-4r3c
github.com/pypa/advisory-database/tree/main/vulns/invenio-previewer/PYSEC-2019-26.yaml
nvd.nist.gov/vuln/detail/CVE-2019-1020019

Code Behaviors & Features

Detect and mitigate CVE-2019-1020019 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →