[rpms/python-tablib] epel8: Escape HTML output - CVE-2026-9318 - rhbz#2514473

[rpms/python-tablib] epel8: Escape HTML output - CVE-2026-9318 - rhbz#2514473

[Steve Traylen]

A new commit has been pushed.

Repo   : rpms/python-tablib
Branch : epel8
Commit : 9cd42798cb96ab61e088bc87c9e3da7855280acb
Author : Steve Traylen <steve.traylen@cern.ch>
Date   : 2026-08-18T14:11:03+02:00
Stats  : +26/-2 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/python-tablib/c/9cd42798cb96ab61e088bc87c9e3da7855280acb?branch=epel8

Log:
Escape HTML output - CVE-2026-9318 - rhbz#2514473

---
diff --git a/fix-cve-CVE-2026-9318.patch b/fix-cve-CVE-2026-9318.patch
new file mode 100644
index 0000000..aa61557
--- /dev/null
+++ b/fix-cve-CVE-2026-9318.patch
@@ -0,0 +1,20 @@
+diff '--color=auto' -uNr tablib-3.0.0.ORG/src/tablib/formats/_html.py tablib-3.0.0/src/tablib/formats/_html.py
+--- tablib-3.0.0.ORG/src/tablib/formats/_html.py	2026-08-17 20:44:03.911284945 +0200
++++ tablib-3.0.0/src/tablib/formats/_html.py	2026-08-17 20:49:55.152211521 +0200
+@@ -2,6 +2,7 @@
+ """
+ 
+ import codecs
++import html
+ from io import BytesIO
+ 
+ from MarkupPy import markup
+@@ -55,7 +56,7 @@
+ 
+         for i, dset in enumerate(databook._datasets):
+             title = (dset.title if dset.title else 'Set %s' % (i))
+-            wrapper.write(f'<{cls.BOOK_ENDINGS}>{title}</{cls.BOOK_ENDINGS}>\n')
++            wrapper.write(f'<{cls.BOOK_ENDINGS}>{html.escape(title)}</{cls.BOOK_ENDINGS}>\n')
+             wrapper.write(dset.html)
+             wrapper.write('\n')
+ 

diff --git a/python-tablib.spec b/python-tablib.spec
index 4b3f10e..03b60ac 100644
--- a/python-tablib.spec
+++ b/python-tablib.spec
@@ -2,12 +2,16 @@
 
 Name:             python-tablib
 Version:          3.0.0
-Release:          1%{?dist}
+Release:          2%{?dist}
 Summary:          Format agnostic tabular data library (XLS, JSON, YAML, CSV)
 
 License:          MIT
 URL:              http://github.com/kennethreitz/tablib
 Source0:          %{pypi_source}
+# https://github.com/jazzband/tablib/commit/b0ff39fb9b2f457e5332249b4cc2ec11eabf46ee
+# https://github.com/jazzband/tablib/pull/668
+# https://nvd.nist.gov/vuln/detail/CVE-2026-9318
+Patch0:           fix-cve-CVE-2026-9318.patch
 BuildArch:        noarch
 
 %global _description\
@@ -42,7 +46,7 @@ Requires:       python3dist(pyyaml)
 %description -n python3-%{srcname} %{_description}
 
 %prep
-%autosetup -n %{srcname}-%{version}
+%autosetup -n %{srcname}-%{version} -p1
 
 %build
 %py3_build