CVE-2026-9318 is a stored cross-site scripting vulnerability in Jazzband's tablib library prior to version 3.10.0. The flaw exists in the HTML export functionality, specifically in the export_book method of the _html.py format handler. Dataset titles derived from worksheet names in imported files (e.g., XLSX, ODS, XLS, YAML) are interpolated into HTML output without proper sanitization or neutralization. Attackers can exploit this by embedding malicious JavaScript in worksheet names, which then execute when the HTML output is rendered in a browser, potentially leading to session hijacking and unauthorized actions.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when viewing the exported HTML. This can result in session hijacking, unauthorized administrative actions, and exposure of sensitive information. The vulnerability requires the victim to open a maliciously crafted HTML export generated by tablib with attacker-controlled dataset titles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid importing untrusted files that could contain malicious worksheet names and be cautious when rendering HTML exports generated by tablib. Consider sanitizing or escaping dataset titles before rendering them in HTML output as a temporary mitigation.