Live › vulnerability › CVE-2026-110757
Go to dashboardText::CSV_XS for Perl before 1.65 writes numeric-looking strings without quotes, so a value containing a newline splits one CSV record into two. An attacker who controls a field that is validated as a number can inject extra rows into generated CSV output.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
print $Text::CSV_XS::VERSION and check the result is below 1.65Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.
combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline.
A value validated as a number can end the record early and turn the fields after it into a separate row.
This page as .md · .json · in your agent: get_signal("CVE-2026-110757")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.