CVE-2026-9318
Received Received - Intake

Stored XSS in Tablib HTML Export via Dataset Titles

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-09-01
AI Q&A
2026-08-12
EPSS Evaluated
2026-08-31
NVD
CVE-2026-9318
EUVD
EUVD-2026-57063

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
tablib tablib to 3.10.0 (exc)
jazzband tablib to 3.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the tablib library affecting versions prior to 3.10.0. It occurs during HTML export when dataset titles containing malicious JavaScript payloads are not properly sanitized. These payloads are then rendered unsanitized in HTML output, specifically inside an h3 tag, allowing attackers to execute arbitrary scripts when the output is viewed in a browser.

Detection Guidance

To detect this vulnerability, inspect tablib versions in use. Check for versions prior to 3.10.0. Review HTML exports for unsanitized dataset titles. Examine imported files like XLSX, ODS, XLS, or YAML for malicious script payloads in sheet names or titles.

Impact Analysis

An attacker could exploit this to execute arbitrary JavaScript in your browser session. This may lead to session hijacking, unauthorized administrative actions, or exposure of sensitive data if you view or interact with the exported HTML content. The impact depends on the privileges of the affected user and the context in which the HTML is viewed.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions may face compliance breaches, legal liabilities, and reputational damage if exploited.

Mitigation Strategies

Upgrade tablib to version 3.10.0 or later. Ensure dataset titles are properly escaped during HTML serialization. Review and sanitize imported files before processing. Monitor for unusual activity in exported HTML outputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9318. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart