# CVE-2026-9318: python-tablib: tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that all...

CVE-2026-9318 is fixed in 10 products on 1 platform, first by DEBIAN-CVE-2026-9318, released August 13, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-9318
- Priority: Routine
- CVSS: n/a (moderate)
- EPSS: 0.0030
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 12, 2026

## Description

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | python-tablib Debian 14 | 3.10.0-1 | [DEBIAN-CVE-2026-9318](https://patchblox.com/security/data/fix/linux/debian-cve-2026-9318.md) | Aug 13, 2026 |
| Linux | python-tablib Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib+all Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib+cli Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib+html Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib+ods Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib+pandas Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib+xls Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib+xlsx Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |
| Linux | python3-tablib+yaml Fedora 43 | 3.10.0-1.fc43 | [FEDORA-2026-81AD01B22A](https://patchblox.com/security/data/fix/linux/fedora-2026-81ad01b22a.md) | Aug 17, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.