Description

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T03:16:43.233Z",
  "pubdate": "2026-08-12T03:16:43.233Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in the HTML export functionality of tablib prior to version 3.10.0. The flaw allows remote attackers to execute arbitrary JavaScript within a victim's browser context by supplying malicious payloads embedded within dataset titles. This vulnerability arises due to the lack of proper input sanitization and output encoding when dataset titles are interpolated directly into the generated HTML structure. Successful exploitation of this vulnerability can lead to severe security implications, including session hijacking, the execution of unauthorized administrative actions, and the exposure of sensitive user data when exported HTML outputs are rendered in a browser. The attacker's capability relies on crafting malicious input vectors within worksheet titles of imported file formats such as XLSX, ODS, XLS, or YAML, which are subsequently processed and exported via the affected application.",
  "technicalDetails": "The vulnerability resides in the export_book method implemented within the _html.py format handler of the tablib library, affecting all versions prior to 3.10.0. The root cause of the vulnerability is the unsafe handling and direct interpolation of dataset titles into the output HTML stream without prior sanitization or context-aware output encoding. Specifically, when processing data exports, tablib assigns worksheet names from imported files to the Dataset title attribute, which are then rendered unescaped directly inside an HTML h3 tag.\nThe attack flow begins when an attacker crafts a malicious input file—such as an XLSX, ODS, XLS, or YAML document—containing executable JavaScript payloads within the worksheet sheet names or titles. Upon ingestion by the target application utilizing the vulnerable tablib library, these malicious titles are bound to the Dataset title attribute. When the application subsequently invokes the export_book method to generate an HTML representation of the dataset, the unsanitized payload is written directly into the HTML markup inside the h3 element.\nWhen a user or administrator renders the resulting HTML export in a web browser, the browser interprets the embedded payload as executable script code rather than plain text. This achieves stored cross-site scripting, executing within the security context of the viewing user's session. Depending on the privileges of the victim, post-exploitation impact includes session hijacking via cookie theft, the performance of unauthorized administrative actions on behalf of the user, and the exfiltration of sensitive application data accessible within the Document Object Model (DOM)."
}