Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-110757: Perl Text::CSV_XS may split CSV rows when numbers lack quotes

CVE-2026-110757 · published 19 days ago

Summary

Older versions of the Perl Text::CSV_XS library (found in Debian and Ubuntu packages) can treat a numeric-looking string with a hidden newline as a plain number and write it without surrounding quotes. This can cause the CSV line to break early, creating extra rows and corrupting data. Upgrade the library to version 1.65 or later to prevent the issue.

What to do

Update debian libtext-csv-xs-perl to version 1.65-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	libtext-csv-xs-perl	All versions
Debian:14	debian	libtext-csv-xs-perl	< 1.65-1 Fix: upgrade to 1.65-1
Ubuntu:16.04:LTS	canonical	libtext-csv-xs-perl	All versions

Original advisory text

Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine

Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline. A value validated as a number can end the record early and turn the fields after it into a separate row.

References

https://github.com/cpan-authors/Text-CSV_XS/commit/fcfb796cb50de9cef8b94a7053530... Patch
https://security-tracker.debian.org/tracker/CVE-2026-110757 Vendor Advisory
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes Vendor Advisory
https://cpan.org/modules URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1107... Vendor Advisory
https://github.com/cpan-authors/Text-CSV_XS Product
https://nvd.nist.gov/vuln/detail/CVE-2026-110757 Vendor Advisory
https://ubuntu.com/security/CVE-2026-110757 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-110757 Third Party Advisory
https://lists.security.metacpan.org/cve-announce/msg/44408694/ Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-116Improper Encoding or Escaping of Output

Timeline

Published16 Oct 2026

Updated4 Nov 2026

First seen16 Oct 2026

Sources

CVE-2026-110757 · NVD

DEBIAN-CVE-2026-110757 · OSV

CVE-2026-110757 · MITRE

CVE-2026-110757 · OSV

UBUNTU-CVE-2026-110757 · OSV

Track software like this

Free during beta