[GHSA-gqgw-jghv-mxwx] tablib prior to 3.10.0 contains a stored cross-site...

[antonisloukis]

Updates

• Affected products
• CVSS v3
• CVSS v4
• Source code location
• Summary

Comments
This advisory is missing the affected package/version metadata and source code location.

The upstream tablib project identifies the affected package as tablib. The vulnerability was fixed by pull request #668, which explicitly references CVE-2026-9318, and the fix was released in version 3.10.0.

Added:

• Ecosystem: pip
• Package: tablib
• Affected versions: < 3.10.0
• Patched version: 3.10.0
• Source repository: https://github.com/jazzband/tablib

Upstream fix:
jazzband/tablib#668

Fixed release:
https://github.com/jazzband/tablib/releases/tag/v3.10.0

The CVSS v4 vector was normalized by omitting optional metrics set to X (Undefined); this does not change the existing CVSS score or assessment.

[antonisloukis]

Note: the advisory improvement form generated this PR with the existing CVSS v3 entry removed while normalizing the CVSS v4 vector.

My intended changes are the missing package/version metadata, source repository, summary, and CVSS v4 normalization. I did not intend to remove the existing CVSS v3 assessment, so please retain it if appropriate during curation.

[advisory-database]

Hi @antonisloukis! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!