CVE-2026-110757

Received Received - Intake

Text::CSV_XS Perl Module Integer Flag Record Splitting

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline. A value validated as a number can end the record early and turn the fields after it into a separate row.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-110757

EUVD

EUVD-2026-103197

Affected Vendors & Products

Vendor	Product	Version / Range
perl	text	to 1.65 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This vulnerability affects Text::CSV_XS versions before 1.65 for Perl. It allows record splitting when strings used as numbers without quotes are processed by the combine function. Perl sets integer or numeric flags on strings used in numeric operations, which can include leading or trailing whitespace. When binary mode is enabled, values like '12\n' may pass numeric checks and be written unquoted, including the newline character. This can prematurely end a record and shift subsequent fields into a new row.

Detection Guidance

This vulnerability affects Perl's Text::CSV_XS module versions before 1.65. To detect it, check the installed version of Text::CSV_XS using the command: perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION' If the version is less than 1.65, the system is vulnerable.

Impact Analysis

This vulnerability could cause data corruption in CSV files processed by affected Perl applications. Malformed CSV output may split records incorrectly, leading to misaligned data fields. Applications relying on CSV parsing for input or output could produce or consume invalid data, potentially causing errors or unexpected behavior in downstream systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Perl CSV parsing library. The issue involves improper handling of numeric strings in CSV data, which could lead to data corruption or misinterpretation during processing. Compliance impacts would only occur if this vulnerability caused data integrity issues in systems handling regulated data.

Mitigation Strategies

Upgrade Text::CSV_XS to version 1.65 or later to address the record splitting issue. Review Perl scripts using this module for improper numeric field handling and ensure strings used in numeric operations are properly quoted.

Hi! I’m here to help you understand CVE-2026-110757. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70