CVE-2026-9318

Name of the Vulnerable Software and Affected Versions tablib versions prior to 3.10.0

Description A stored cross-site scripting issue exists in the HTML export functionality. Attackers can execute arbitrary JavaScript by embedding malicious payloads in dataset titles. This occurs when the export book() function in the html.py format handler interpolates these titles unsanitized into the HTML output, rendering them unescaped inside an HTML h3 tag. The attack can be triggered by renaming worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads assigned to the Dataset title attribute. This can lead to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.

Recommendations Update to version 3.10.0 or later.