Tablib
Monthly
Stored XSS in tablib's HTML export path before version 3.10.0 allows an authenticated attacker to inject arbitrary JavaScript via maliciously named worksheet titles sourced from imported XLSX, ODS, XLS, or YAML files. The export_book method in _html.py previously interpolated dataset titles directly into HTML h3 tags using an f-string, bypassing all escaping; script payloads assigned to the Dataset title attribute execute in a victim's browser when the exported HTML is rendered. No active exploitation confirmed in CISA KEV; vendor-released patch is available as v3.10.0.
An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Stored XSS in tablib's HTML export path before version 3.10.0 allows an authenticated attacker to inject arbitrary JavaScript via maliciously named worksheet titles sourced from imported XLSX, ODS, XLS, or YAML files. The export_book method in _html.py previously interpolated dataset titles directly into HTML h3 tags using an f-string, bypassing all escaping; script payloads assigned to the Dataset title attribute execute in a victim's browser when the exported HTML is rendered. No active exploitation confirmed in CISA KEV; vendor-released patch is available as v3.10.0.
An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.