CVE-2026-9318: CVE-2026-9318: Stored Cross-Site Scripting via HTML Export in Jazzband tablib

#security #cve #cybersecurity

CVE-2026-9318: Stored Cross-Site Scripting via HTML Export in Jazzband tablib

Vulnerability ID: CVE-2026-9318
CVSS Score: 5.4
Published: 2026-08-12

CVE-2026-9318 is a stored cross-site scripting (XSS) vulnerability affecting Jazzband tablib versions prior to 3.10.0. The flaw is located in the HTML export functionality of multi-sheet Databook objects. Due to raw f-string interpolation, unsanitized sheet titles containing malicious script tags are rendered directly as HTML, allowing arbitrary client-side code execution in a victim's browser.

TL;DR

A stored XSS vulnerability in Jazzband tablib prior to 3.10.0 allows remote attackers to execute arbitrary JavaScript in browsers via crafted spreadsheet sheet names processed through HTML export pipelines.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 5.4 (Medium)
EPSS Score: 0.00181
Impact: Arbitrary client-side script execution (Stored XSS)
Exploit Status: Proof of Concept (PoC) available
KEV Status: Not listed

Affected Systems

Jazzband tablib library (Python)
tablib: < 3.10.0 (Fixed in: 3.10.0)

Code Analysis

Commit: 4a18004

Escape book title for html format

@@ -47,7 +47,9 @@ def export_book(cls, databook):
         result = ''
         for i, dset in enumerate(databook._datasets):
             title = dset.title if dset.title else f'Set {i}'
-            result += f'<{cls.BOOK_ENDINGS}>{title}</{cls.BOOK_ENDINGS}>\n'
+            title_el = ET.Element(cls.BOOK_ENDINGS)
+            title_el.text = title
+            result += ET.tostring(title_el, method='html', encoding='unicode') + '\n'
             result += dset.html
             result += '\n'

Exploit Details

GitHub Pull Request #668: The pull request includes integration test cases demonstrating the parsing of malicious sheet names triggering execution during the HTML export.

Mitigation Strategies

Upgrade tablib to version 3.10.0 or higher.
Sanitize sheet names during application-level import validation pipelines.
Enforce a robust Content Security Policy (CSP) restricting inline script execution.
Set HttpOnly flags on session cookies to block XSS-based cookie theft.

Remediation Steps:

Update requirements.txt or setup.py to enforce tablib>=3.10.0.
Run pip install --upgrade tablib to apply the updated release in deployment environments.
Implement a validator function in the file ingestion route to reject sheet names containing angle brackets or script patterns.

References

Read the full report for CVE-2026-9318 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community