THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-gqgw-jghv-mxwx (medium) — tablib: Stored XSS in the HTML export via unescaped dataset title

[GHSA] GHSA-gqgw-jghv-mxwx (medium) — tablib: Stored XSS in the HTML export via unescaped dataset title

medgithub_advisoriesPublished 2026-08-12

GHSA-gqgw-jghv-mxwx Severity: medium CVE: CVE-2026-9318

tablib: Stored XSS in the HTML export via unescaped dataset title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the ex

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-9318cve

Original source: https://github.com/advisories/GHSA-gqgw-jghv-mxwx