CVE-2026-9318: tablib Stored XSS Vulnerability

CVE-2026-9318 Overview

CVE-2026-9318 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the tablib Python library prior to version 3.10.0. The flaw resides in the HTML export functionality, specifically the export_book method in the _html.py format handler. Attackers can embed JavaScript payloads in dataset titles, which tablib interpolates unsanitized into an HTML <h3> tag. Worksheet sheet names from imported XLSX, ODS, XLS, or YAML files are assigned to the Dataset.title attribute and rendered unescaped when exported. Rendering the resulting HTML in a browser executes the attacker-controlled script.

Critical Impact
Successful exploitation enables session hijacking, unauthorized administrative actions, and sensitive data exposure in the context of any user who views the exported HTML.

Affected Products

tablib versions prior to 3.10.0
Python applications that import untrusted spreadsheet files (XLSX, ODS, XLS, YAML) using tablib
Web applications that render tablib HTML export output in a browser

Discovery Timeline

2026-08-12 - CVE-2026-9318 published to the National Vulnerability Database
2026-08-12 - CVE record last modified in NVD

Technical Details for CVE-2026-9318

Vulnerability Analysis

The vulnerability is a classic stored XSS pattern in a data-serialization library. tablib converts datasets to multiple formats, including HTML, through per-format handlers. The HTML handler responsible for producing multi-sheet output constructs section headings using each dataset's title attribute without HTML-escaping the value.

When an application ingests a workbook such as XLSX or ODS, tablib maps each worksheet's sheet name to the corresponding Dataset.title. An attacker who controls a sheet name can rename it to a payload such as a <script> block or an event-handler attribute. On export, that string is concatenated directly into the <h3> heading in the generated HTML.

Exploitation requires that a downstream user render or preview the exported HTML in a browser. The payload then executes in the origin serving that HTML, giving the attacker access to cookies, session tokens, and any application state accessible from that origin.

Root Cause

The root cause is missing output encoding in the export_book code path of _html.py. The dataset title is treated as trusted markup rather than untrusted text and is not passed through an HTML escaper before interpolation into the template.

Attack Vector

The attack vector is network-accessible file upload or import workflows. An attacker crafts a spreadsheet or YAML file whose sheet or dataset name contains a JavaScript payload, then submits it through any application feature that converts uploaded data to HTML using tablib. User interaction is required to view the rendered output. Additional technical context is available in the VulnCheck Security Advisory and GitHub Pull Request #668.

No verified public proof-of-concept code is available for this CVE. See the linked references for technical details of the fix.

Detection Methods for CVE-2026-9318

Indicators of Compromise

Spreadsheet or YAML files containing sheet or dataset names with HTML tags, <script> fragments, or JavaScript event-handler attributes such as onerror or onclick
HTML output produced by tablib containing unescaped angle brackets or script content inside <h3> elements
Browser console errors or unexpected outbound requests originating from pages that render tablib-generated HTML exports

Detection Strategies

Inspect imported workbook metadata and reject sheet names that contain HTML control characters before passing them to tablib
Run static analysis on Python codebases for calls to tablib export, book.html, or Databook HTML export paths and verify the tablib version pinned in requirements.txt or pyproject.toml
Add web application firewall rules to flag HTTP responses containing tablib-generated HTML with script-like content inside heading tags

Monitoring Recommendations

Log all file upload events that feed into tablib import routines, including the original filename and sheet names
Monitor endpoints that serve rendered HTML exports for anomalous script inclusion or outbound token exfiltration attempts
Correlate authentication anomalies, such as session reuse from new IPs, with recent HTML export downloads by the same user

How to Mitigate CVE-2026-9318

Immediate Actions Required

Upgrade tablib to version 3.10.0 or later in all production and development environments
Audit application code paths that expose tablib HTML export output to end users
Rotate session tokens for users who may have rendered attacker-controlled HTML exports

Patch Information

The fix is included in tablib release v3.10.0 and merged via GitHub Pull Request #668. The patch adds HTML escaping to the dataset title before it is interpolated into the exported markup. Source code is available in the tablib GitHub repository.

Workarounds

Sanitize or validate sheet and dataset names on import, stripping or escaping HTML metacharacters before assignment to Dataset.title
Serve tablib HTML export output with a strict Content Security Policy that blocks inline scripts
Convert tablib output to a non-HTML format such as CSV or JSON when the source data is untrusted

bash

# Configuration example
pip install --upgrade 'tablib>=3.10.0'
pip show tablib | grep -i version