CVE-2026-9318

tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

Medium4.8EPSS 0.30%

Published: 12 Aug 2026
Updated: 8 Oct 2026
Reserved: 22 May 2026
Assigned by: VulnCheck

Description

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.

Scores

CVSS scores of CVE-2026-9318, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium4.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
VulnCheckCNA (assigner)	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVDNVD · Awaiting Analysis	4.0	Medium4.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.30% · top 77% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

Jazzband · tablib
- affected < 3.10.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

PyPItablibGHSA-gqgw-jghv-mxwx (opens in a new tab)

References (4)

Product Repository (opens in a new tab)product
Pull Request (opens in a new tab)issue-tracking
Patch Release (opens in a new tab)patch
https://www.vulncheck.com/advisories/tablib-versions-prior-to-stored-xss-via-html-export-dataset-title (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-9318](https://trackcve.app/badge/CVE-2026-9318.svg)](https://trackcve.app/cve/CVE-2026-9318)

Record last updated 8 Oct 2026, 15:26 UTC.