CVE-2017-2810

High

Published: 14/06/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4, allowing arbitrary Python command execution. An attacker can inject Python code into loaded YAML to trigger this vulnerability.

Risk Assessment

This vulnerability may lead to unauthorized code execution, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to update Tablib to the latest version to mitigate this vulnerability and to implement controls over YAML data being loaded into the system.

Other vulnerabilities in Tablib 0.11.4

CVE-2026-9318Medium
In tablib prior to 3.10.0, a stored cross-site scripting vulnerability exists in the HTML export functionality. Malicious payloads in dataset titles are interpolated unsanitized into HTML output, allowing arbitrary JavaScript execution.

Original NVD description (English source)

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.