Detections
Analytics

SCA: security update for tablib (GHSA-gqgw-jghv-mxwx)

medium Tenable Self-Hosted Container Security Plugin ID 445898

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export
 functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in
 dataset titles, which are interpolated unsanitized into HTML output via the export_book method in the
 _html.py format handler. Attackers can rename worksheet sheets in imported files such as XLSX, ODS, XLS,
 or YAML with script payloads that are assigned to the Dataset title attribute and rendered unescaped
 inside an HTML h3 tag, leading to session hijacking, unauthorized administrative actions, and sensitive
 data exposure when the output is rendered in a browser. (CVE-2026-9318)

Solution

Update the tablib library and its related packages to version 3.10.0 or later.

See Also

https://github.com/advisories/GHSA-gqgw-jghv-mxwx

Plugin Details

Severity: Medium

ID: 445898

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/13/2026

Updated: 8/13/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.73

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-9318

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/12/2026

Vulnerability Publication Date: 8/12/2026

Reference Information

CVE: CVE-2026-9318

cwe: CWE-79