tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-81ad01b22a advisory.

    Resolves: https://nvd.nist.gov/vuln/detail/CVE-2026-9318

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-eaa6ecd43e advisory.

    Resolves: https://nvd.nist.gov/vuln/detail/CVE-2026-9318

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a0344d94aa advisory.

    Automatic update for python-tablib-3.10.0-1.fc45.

    ##### **Changelog**

    ```
    * Mon Aug 17 2026 Steve Traylen <steve.traylen@cern.ch> - 3.10.0-1
    - Update to v3.10.0 CVE-2026-9318
    - Resolves: rhbz#2514472

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d69d02ea41 advisory.

    Automatic update for python-tablib-3.10.0-1.fc46.

    ##### **Changelog**

    ```
    * Mon Aug 17 2026 Steve Traylen <steve.traylen@cern.ch> - 3.10.0-1
    - Update to v3.10.0 CVE-2026-9318
    - Resolves: rhbz#2514472

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export
    functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in
    dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the
    _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS,
    or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped
    inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive
    data exposure when the output is rendered in a browser. (CVE-2026-9318)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export     functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in     dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the
    _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS,     or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped     inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive     data exposure when the output is rendered in a browser. (CVE-2026-9318)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
339705	Fedora 43 : python-tablib (2026-81ad01b22a)	Nessus	Fedora Local Security Checks	Local	medium
339703	Fedora 44 : python-tablib (2026-eaa6ecd43e)	Nessus	Fedora Local Security Checks	Local	medium
336073	Fedora 45 : python-tablib (2026-a0344d94aa)	Nessus	Fedora Local Security Checks	Local	medium
336072	Fedora 46 : python-tablib (2026-d69d02ea41)	Nessus	Fedora Local Security Checks	Local	medium
445898	SCA: security update for tablib (GHSA-gqgw-jghv-mxwx)	Tenable Cloud Security	SCA Checks	Local	medium
445898	SCA: security update for tablib (GHSA-gqgw-jghv-mxwx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
334900	Linux Distros Unpatched Vulnerability : CVE-2026-9318	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-9318

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium