Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-9318— tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title

Quick assessment

Affected
Jazzband tablib
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Jazzband tablib是Jazzband团队的一个表格数据格式处理库。 Jazzband tablib 3.10.0之前版本存在跨站脚本漏洞，该漏洞源于HTML导出功能中数据集标题未经过滤和转义，攻击者可在导入文件的工作表名称中嵌入恶意有效载荷，导致在浏览器中渲染时执行任意JavaScript，造成会话劫持、未授权管理操作和敏感数据泄露。

CVSS 5.4 · Medium EPSS 0.30% · P22

Affected Version Matrix 1

VendorProduct Version RangeStatus
Jazzband tablib < 3.10.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-9318

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title
Source: CVE Program / CVE List V5
Vulnerability Description
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Jazzband tablib 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Jazzband tablib是Jazzband团队的一个表格数据格式处理库。 Jazzband tablib 3.10.0之前版本存在跨站脚本漏洞，该漏洞源于HTML导出功能中数据集标题未经过滤和转义，攻击者可在导入文件的工作表名称中嵌入恶意有效载荷，导致在浏览器中渲染时执行任意JavaScript，造成会话劫持、未授权管理操作和敏感数据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Jazzband tablib 0 ~ 3.10.0 -

II. Public POCs for CVE-2026-9318

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9318

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-9318 (1)

Vendor Pages for CVE-2026-9318 (1)

Other References for CVE-2026-9318 (2)

IV. Related Vulnerabilities

Same product: tablib
Same vendor: Jazzband
Same weakness: CWE-79