https://vulnerability.circl.lu/sightings/feed 2026-08-13T18:19:23.602397+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/659bb801-1ba0-4489-8dfe-2a4b9989ed40/export 2026-08-13T18:19:23.630835+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "659bb801-1ba0-4489-8dfe-2a4b9989ed40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9318", "type": "seen", "source": "https://gist.github.com/alon710/ab9c4f805cc0c3bef62e3b400512696a", "content": "# CVE-2026-9318: CVE-2026-9318: Stored Cross-Site Scripting via HTML Export in Jazzband tablib\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-12\n> **Full Report:** https://cvereports.com/reports/CVE-2026-9318\n\n## Summary\nCVE-2026-9318 is a stored cross-site scripting (XSS) vulnerability affecting Jazzband tablib versions prior to 3.10.0. The flaw is located in the HTML export functionality of multi-sheet Databook objects. Due to raw f-string interpolation, unsanitized sheet titles containing malicious script tags are rendered directly as HTML, allowing arbitrary client-side code execution in a victim's browser.\n\n## TL;DR\nA stored XSS vulnerability in Jazzband tablib prior to 3.10.0 allows remote attackers to execute arbitrary JavaScript in browsers via crafted spreadsheet sheet names processed through HTML export pipelines.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00181\n- **Impact**: Arbitrary client-side script execution (Stored XSS)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Jazzband tablib library (Python)\n- **tablib**: < 3.10.0 (Fixed in: `3.10.0`)\n\n## Mitigation\n\n- Upgrade tablib to version 3.10.0 or higher.\n- Sanitize sheet names during application-level import validation pipelines.\n- Enforce a robust Content Security Policy (CSP) restricting inline script execution.\n- Set HttpOnly flags on session cookies to block XSS-based cookie theft.\n\n**Remediation Steps:**\n1. Update requirements.txt or setup.py to enforce tablib>=3.10.0.\n2. Run pip install --upgrade tablib to apply the updated release in deployment environments.\n3. Implement a validator function in the file ingestion route to reject sheet names containing angle brackets or script patterns.\n\n## References\n\n- [Jazzband tablib Repository](https://github.com/jazzband/tablib)\n- [Pull Request #668: Escape book title for html format](https://github.com/jazzband/tablib/pull/668)\n- [Fix Commit Patch file](https://github.com/jazzband/tablib/pull/668.patch)\n- [tablib 3.10.0 Release Notes](https://github.com/jazzband/tablib/releases/tag/v3.10.0)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/tablib-versions-prior-to-stored-xss-via-html-export-dataset-title)\n- [NVD CVE-2026-9318 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-9318)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-9318)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-9318) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-13T00:01:14.232052Z"} 2026-08-13T00:01:14.232052+00:00 https://vulnerability.circl.lu/sighting/d09b0273-1c5a-4376-a077-46676b7cb653/export 2026-08-13T18:19:23.633039+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "d09b0273-1c5a-4376-a077-46676b7cb653", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9318", "type": "seen", "source": "https://gist.github.com/alon710/ab9c4f805cc0c3bef62e3b400512696a", "content": "# CVE-2026-9318: CVE-2026-9318: Stored Cross-Site Scripting via HTML Export in Jazzband tablib\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-08-12\n> **Full Report:** https://cvereports.com/reports/CVE-2026-9318\n\n## Summary\nCVE-2026-9318 is a stored cross-site scripting (XSS) vulnerability affecting Jazzband tablib versions prior to 3.10.0. The flaw is located in the HTML export functionality of multi-sheet Databook objects. Due to raw f-string interpolation, unsanitized sheet titles containing malicious script tags are rendered directly as HTML, allowing arbitrary client-side code execution in a victim's browser.\n\n## TL;DR\nA stored XSS vulnerability in Jazzband tablib prior to 3.10.0 allows remote attackers to execute arbitrary JavaScript in browsers via crafted spreadsheet sheet names processed through HTML export pipelines.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00181\n- **Impact**: Arbitrary client-side script execution (Stored XSS)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Jazzband tablib library (Python)\n- **tablib**: < 3.10.0 (Fixed in: `3.10.0`)\n\n## Mitigation\n\n- Upgrade tablib to version 3.10.0 or higher.\n- Sanitize sheet names during application-level import validation pipelines.\n- Enforce a robust Content Security Policy (CSP) restricting inline script execution.\n- Set HttpOnly flags on session cookies to block XSS-based cookie theft.\n\n**Remediation Steps:**\n1. Update requirements.txt or setup.py to enforce tablib>=3.10.0.\n2. Run pip install --upgrade tablib to apply the updated release in deployment environments.\n3. Implement a validator function in the file ingestion route to reject sheet names containing angle brackets or script patterns.\n\n## References\n\n- [Jazzband tablib Repository](https://github.com/jazzband/tablib)\n- [Pull Request #668: Escape book title for html format](https://github.com/jazzband/tablib/pull/668)\n- [Fix Commit Patch file](https://github.com/jazzband/tablib/pull/668.patch)\n- [tablib 3.10.0 Release Notes](https://github.com/jazzband/tablib/releases/tag/v3.10.0)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/tablib-versions-prior-to-stored-xss-via-html-export-dataset-title)\n- [NVD CVE-2026-9318 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-9318)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-9318)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-9318) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-12T23:31:35.981304Z"} 2026-08-12T23:31:35.981304+00:00 https://vulnerability.circl.lu/sighting/b9b32415-b772-4333-aa34-b7bf2f59b07a/export 2026-08-13T18:19:23.633309+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "b9b32415-b772-4333-aa34-b7bf2f59b07a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9318", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ggty6bussgrsk", "content": "CVE-2026-9318 - tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title\nCVE ID : CVE-2026-9318\n \n Published : 2026\u5e748\u670812\u65e5 03:16 | 1\u00a0\u5c0f\u65f6\uff0c15\u00a0\u5206\u949f ago\n \n Description : tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export func...", "creation_timestamp": "2026-08-12T04:49:10.353589Z"} 2026-08-12T04:49:10.353589+00:00