An exploitable vulnerability exists in the Databook loading functionality of Tablib…
Priority MEDIUM 50Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability.
Why it matters now
EPSS 0.0487 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial tablib (PyPI): 0.11.5Red Hat: 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kenneth Reitz | Tablib | 0.11.4 | — | No fix listed | CNA |
| — | tablib (PyPI) | before 0.11.5 | 0.11.5 | Patch available | GHSA-gcr6-rf47-jrgf |
- Tablib VendorKenneth Reitz Affected 0.11.4 Fixed in — No fix listed CNA
- tablib (PyPI) Vendor— Affected before 0.11.5 Fixed in 0.11.5 Patch available GHSA-gcr6-rf47-jrgf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:tablib:0.11.4:*:*:*:*:*:*:* | 0.11.4 | Vulnerable | python-pillow |
- cpe:2.3:a:python:tablib:0.11.4:*:*:*:*:*:*:* Versions 0.11.4 Vulnerable ·python-pillow
Remediation
- Fix · GHSA-gcr6-rf47-jrgf tablib (PyPI) Fixed in 0.11.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 11 (Ocata) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 8 (Liberty) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat OpenStack Platform 12 (Pike)
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2810
- 2026-10-03 Alias added: GHSA-gcr6-rf47-jrgf
References
Advisory 3
Sources
- CVE-2017-2810 · CVE Program
- CVE-2017-2810 · NVD
- FIRST EPSS
- GHSA-gcr6-rf47-jrgf · GitHub Advisory Database · CC BY 4.0
- CVE-2017-2810 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences