CVE-2026-9318: tablib Stored XSS Vulnerability in HTML Export Functionality
Summary
CVE-2026-9318: tablib: Stored XSS in the HTML export via unescaped dataset title. Affects tablib versions < 3.10.0. Fixed in 3.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tablib is a popular Python library used for data serialization and export in various formats, including XLSX, ODS, and YAML. It allows users to create and manipulate datasets easily. However, prior to version 3.10.0, tablib had a vulnerability that could lead to stored cross-site scripting (XSS) attacks, particularly in its HTML export feature.
Vulnerability Detail
The vulnerability arises from the unsanitized interpolation of dataset titles into HTML output during the export process. Attackers can exploit this by embedding malicious JavaScript code in the dataset title, which is rendered unescaped in an HTML h3 tag. This can lead to serious consequences, including session hijacking, unauthorized actions, and exposure of sensitive data when the output is viewed in a web browser.
How To Fix
Minimum fixed version
3.10.0
This is the first release that contains the fix.
pip install --upgrade "tablib==3.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using dataset titles that contain special characters or JavaScript code. Ensure that any titles used are sanitized and do not include potentially harmful content.
Conclusion
The stored XSS vulnerability in tablib's HTML export functionality poses significant risks to applications using the library. It is crucial to update to version 3.10.0 or later to protect against potential attacks. Additionally, users should be cautious with dataset titles to avoid embedding harmful scripts.
See every vulnerability recorded for tablib →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to execute arbitrary JavaScript through unsanitized dataset titles in HTML exports.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include session hijacking, unauthorized administrative actions, and exposure of sensitive data when the HTML output is rendered in a browser.
Yes, the vulnerability is fixed in tablib version 3.10.0 and later. It is recommended to update to this version to mitigate the risk.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tablib.
