CVE-2026-9318 in Tablib
Summary
by MITRE • 08/12/2026
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The tablib library represents a popular Python package for handling tabular data formats including csv, json, xml, html, and various spreadsheet formats. Versions prior to 3.10.0 contain a critical stored cross-site scripting vulnerability that directly impacts the HTML export functionality. This vulnerability stems from inadequate input sanitization within the _html.py format handler where dataset titles are interpolated unsanitized into HTML output. The flaw specifically manifests when the export_book method processes datasets that have been imported from various file formats including XLSX, ODS, XLS, or YAML. When attackers manipulate worksheet names during import operations, they can embed malicious JavaScript payloads within these sheet names which then become assigned to the Dataset title attribute.
The technical execution of this vulnerability occurs through the manipulation of dataset titles during the import process where attackers rename worksheets with script payloads that get stored in the Dataset object's title field. These titles are subsequently rendered unescaped within HTML h3 tags during the export process, creating a persistent XSS vector. The vulnerability maps directly to CWE-79 - Cross-site Scripting and aligns with ATT&CK technique T1203 - Exploitation for Client Execution. When users view exported HTML content in web browsers, the malicious JavaScript code executes within the context of the victim's session, potentially leading to full session hijacking.
The operational impact of this vulnerability extends beyond simple script execution to encompass serious security implications including unauthorized administrative actions and sensitive data exposure. Attackers can construct payloads that steal cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users. The stored nature of the vulnerability means that once a malicious payload is embedded in a dataset title during import, it persists in the exported HTML output until the vulnerable application is updated. This makes the vulnerability particularly dangerous in environments where tablib is used for data export functionality and where multiple users may access the same exported content. The risk is amplified when datasets are shared across teams or published in web-accessible locations.
Mitigation strategies include immediate upgrade to tablib version 3.10.0 or later where the XSS vulnerability has been addressed through proper input sanitization of dataset titles before HTML rendering. Organizations should also implement additional defensive measures such as content security policies that restrict script execution in web applications using tablib exports, regular security scanning of imported datasets for suspicious characters, and input validation at multiple layers including file import and export operations. The fix implemented in version 3.10.0 addresses the root cause by ensuring all dataset titles are properly escaped before being interpolated into HTML output, preventing malicious payloads from executing when rendered in browsers. Security teams should also consider implementing automated monitoring for unusual file naming patterns during data import processes as an additional detection mechanism for potential exploitation attempts.