Read the docs
TI-2019-16083 Aliases CVE-2019-1020005GHSA-mfv8-q39f-mgfg

invenio-communities before 1.0.0a20 allows XSS.

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

invenio-communities before 1.0.0a20 allows XSS.

Why it matters now

EPSS 0.00682 52nd percentileScored 2026-11-07
Fix Fixed invenio-communities (Invenio): 1.0.0a20invenio-communities (PyPI): 1.0.0a20

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Invenioinvenio-communitiesbefore 1.0.0a201.0.0a20Patch availableCNA
—invenio-communities (PyPI)before 1.0.0a201.0.0a20Patch availableGHSA-mfv8-q39f-mgfg
  • invenio-communities VendorInvenio Affected before 1.0.0a20 Fixed in 1.0.0a20 Patch available CNA
  • invenio-communities (PyPI) Vendor— Affected before 1.0.0a20 Fixed in 1.0.0a20 Patch available GHSA-mfv8-q39f-mgfg

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a1:*:*:*:*:*:*1.0.0 a1VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a10:*:*:*:*:*:*1.0.0 a10VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a11:*:*:*:*:*:*1.0.0 a11VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a12:*:*:*:*:*:*1.0.0 a12VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a13:*:*:*:*:*:*1.0.0 a13VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a14:*:*:*:*:*:*1.0.0 a14VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a15:*:*:*:*:*:*1.0.0 a15VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a16:*:*:*:*:*:*1.0.0 a16VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a17:*:*:*:*:*:*1.0.0 a17VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a18:*:*:*:*:*:*1.0.0 a18VulnerableInvenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a1:*:*:*:*:*:* Versions 1.0.0 a1 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a10:*:*:*:*:*:* Versions 1.0.0 a10 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a11:*:*:*:*:*:* Versions 1.0.0 a11 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a12:*:*:*:*:*:* Versions 1.0.0 a12 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a13:*:*:*:*:*:* Versions 1.0.0 a13 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a14:*:*:*:*:*:* Versions 1.0.0 a14 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a15:*:*:*:*:*:* Versions 1.0.0 a15 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a16:*:*:*:*:*:* Versions 1.0.0 a16 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a17:*:*:*:*:*:* Versions 1.0.0 a17 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a18:*:*:*:*:*:* Versions 1.0.0 a18 Vulnerable ·Invenio
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a19:*:*:*:*:*:*1.0.0 a19VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a2:*:*:*:*:*:*1.0.0 a2VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a3:*:*:*:*:*:*1.0.0 a3VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a4:*:*:*:*:*:*1.0.0 a4VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a5:*:*:*:*:*:*1.0.0 a5VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a6:*:*:*:*:*:*1.0.0 a6VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a7:*:*:*:*:*:*1.0.0 a7VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a8:*:*:*:*:*:*1.0.0 a8VulnerableInvenio
cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a9:*:*:*:*:*:*1.0.0 a9VulnerableInvenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a19:*:*:*:*:*:* Versions 1.0.0 a19 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a2:*:*:*:*:*:* Versions 1.0.0 a2 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a3:*:*:*:*:*:* Versions 1.0.0 a3 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a4:*:*:*:*:*:* Versions 1.0.0 a4 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a5:*:*:*:*:*:* Versions 1.0.0 a5 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a6:*:*:*:*:*:* Versions 1.0.0 a6 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a7:*:*:*:*:*:* Versions 1.0.0 a7 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a8:*:*:*:*:*:* Versions 1.0.0 a8 Vulnerable ·Invenio
  • cpe:2.3:a:inveniosoftware:invenio-communities:1.0.0:a9:*:*:*:*:*:* Versions 1.0.0 a9 Vulnerable ·Invenio

Remediation

  • Fix · CNA invenio-communities (Invenio) Fixed in 1.0.0a20
  • Fix · GHSA-mfv8-q39f-mgfg invenio-communities (PyPI) Fixed in 1.0.0a20 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1020005
  2. 2026-10-03 Alias added: GHSA-mfv8-q39f-mgfg

References

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences