tablib, a popular Python library for representing tabular data, can store malicious script payloads in dataset titles that are later exported to HTML without escaping. The HTML export handler directly injects the title into an <h3> element, allowing attackers to execute arbitrary JavaScript when the report is viewed in a browser. If the user is logged in to a web application that processes the exported file, this can lead to session hijacking, unauthorized administrative actions, or exposure of sensitive data.

Any installation of Jazzband tablib earlier than version 3.10.0, regardless of the operating system, that uses the HTML export feature for worksheets imported from XLSX, XLS, ODS or YAML. The problem arises when titles are crafted with script tags; thus systems that generate or serve exported HTML will be vulnerable.

With a CVSS score of 4.8 the vulnerability is considered moderate, and the EPSS score of less than 1 % indicates a low probability of exploitation. The bug is not in the CISA KEV catalog. An attacker would need to place a malicious title in a worksheet, trigger the HTML export, and then get the resulting file rendered in a browser that the victim visits. Once the payload runs, it can steal the victim’s session cookie or perform other client‑side actions.