{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110757", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-14T17:07:22.647Z", "datePublished": "2026-10-16T22:07:56.450Z", "dateUpdated": "2026-10-16T22:07:56.450Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Text::CSV_XS"], "packageName": "Text-CSV_XS", "packageURL": "pkg:cpan/Text-CSV_XS", "programFiles": ["CSV_XS.xs"], "programRoutines": [{"name": "Text::CSV_XS::combine"}, {"name": "Text::CSV_XS::print"}], "repo": "https://github.com/cpan-authors/Text-CSV_XS", "versions": [{"lessThan": "1.65", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.\n\ncombine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, \"12\\n\" passes a check such as $qty > 0 and is then written unquoted with its newline.\n\nA value validated as a number can end the record early and turn the fields after it into a separate row."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-16T22:07:56.450Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/fcfb796cb50de9cef8b94a70535304ac41a50c56.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to Text-CSV_XS 1.65 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-10-14T00:00:00.000Z", "value": "Fix committed to upstream repository."}, {"lang": "en", "time": "2026-10-15T00:00:00.000Z", "value": "Version 1.65 released with fix."}], "title": "Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["Text::CSV_XS"], "packageName": "Text-CSV_XS", "packageURL": "pkg:cpan/Text-CSV_XS", "programFiles": ["CSV_XS.xs"], "programRoutines": [{"name": "Text::CSV_XS::combine"}, {"name": "Text::CSV_XS::print"}], "repo": "https://github.com/cpan-authors/Text-CSV_XS", "versions": [{"lessThan": "1.65", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.\n\ncombine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, \"12\\n\" passes a check such as $qty > 0 and is then written unquoted with its newline.\n\nA value validated as a number can end the record early and turn the fields after it into a separate row."}], "id": "CVE-2026-110757", "lastModified": "2026-10-16T23:17:00.953", "metrics": {}, "published": "2026-10-16T23:17:00.953", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/fcfb796cb50de9cef8b94a70535304ac41a50c56.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-text-csv_xs: Text::CSV_XS: CSV record splitting via unquoted numeric fields", "id": "2554504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554504"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in Text::CSV_XS. An attacker can cause record splitting and data tampering by supplying input containing embedded newline characters that evaluates as numeric. Because the library fails to quote fields flagged as numeric when formatting Comma-Separated Values (CSV) records, the unquoted newline terminates the row prematurely and shifts subsequent fields into an unintended separate record."], "name": "CVE-2026-110757", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "perl-Text-CSV_XS", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "perl-Text-CSV_XS", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "perl-Text-CSV_XS", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-16T22:07:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110757\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110757\nhttps://github.com/cpan-authors/Text-CSV_XS/commit/fcfb796cb50de9cef8b94a70535304ac41a50c56.patch\nhttps://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"], "threat_severity": "Moderate"}

{"created": "2026-10-16T23:30:13.663438+00:00", "updated": "2026-10-17T02:15:14.838183+00:00", "vendors": []}