tablib: Stored XSS in the HTML export via unescaped dataset title
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | tablib | < 3.10.0 | 3.10.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9318
- https://github.com/jazzband/tablib/pull/668
- https://github.com/jazzband/tablib
- https://github.com/jazzband/tablib/releases/tag/v3.10.0
- https://www.vulncheck.com/advisories/tablib-versions-prior-to-stored-xss-via-html-export-dataset-title
- https://pypi.org/project/tablib
- https://github.com/advisories/GHSA-gqgw-jghv-mxwx
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Python (PyPI)
- Package
tablib- Disclosed
- 12.08.2026
- Updated
- 11.10.2026 15:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3702 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-gqgw-jghv-mxwx - CC BY 4.0
Vulnerability history: tablib
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 06.2017 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- Medium 1
Disclosures per year
- 2017: 1
- 2018: 0
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
tablib: Stored XSS in the HTML export via unescaped dataset title this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.