Executive brief
Tablib is a popular Python library used to export data into various formats like Excel, CSV, and HTML. A security flaw allows an attacker to embed malicious code into the titles of data sheets within a file. When this data is later exported to HTML and viewed in a web browser, the malicious code can execute, potentially leading to the theft of user sessions or unauthorized actions on the platform.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Tablib's HTML export handler (_html.py). The root cause is the lack of sanitization of the 'title' attribute of a Dataset object when it is interpolated into an HTML <h3> tag via the export_book method. An attacker can provide a specially crafted file (such as XLSX, ODS, or YAML) containing malicious JavaScript in the sheet names. When a developer uses Tablib to convert this imported data into an HTML report, the script executes in the context of the user's browser. This can lead to session hijacking or sensitive data exposure. The issue is fixed in version 3.10.0.
Affected products
- Jazzband tablib < 3.10.0
Timeline
- 2026-08-12: advisory: NVD publication date
- 2026-08-12: disclosed: GHSA publication date
- 2026-08-12: patched: Version 3.10.0 released
References
- https://api.github.com/users/antonisloukis
- https://github.com/antonisloukis
- https://api.github.com/users/antonisloukis/gists%7B/gist_id%7D
- https://api.github.com/users/antonisloukis/repos
- https://avatars.githubusercontent.com/u/301263012?v=4
- https://api.github.com/users/antonisloukis/events%7B/privacy%7D