Text::CSV_XS CVE-2026-110757

Requires an application that serializes data with Text::CSV_XS combine() or print() in binary mode (the default) BEFORE version 1.65, AND a field whose string value has acquired Perl's integer/numeric flag by being used in a numeric operation (e.g. a validation like $qty > 0 or $s == 12), AND that value still contains an embedded newline, CR, or delimiter while parsing as a number - Perl tolerates leading/trailing whitespace, so "12\n" passes numeric checks yet carries a record-breaking byte. The attacker must control the content of that specific field. Limiting factors: the flaw affects only the WRITE/serialization path, not CSV parsing; it is inert unless the value transits a numeric operation before combine/print; and impact is realized only when a downstream consumer re-parses the split output. It is not exploitable merely by reading CSV.

Signals conflict sharply. The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is almost certainly overstated for what the description and the fixing commit actually show: this is an improper-output-encoding / record-splitting flaw (CWE-116) in a CSV serialization library, not a memory-corruption or RCE bug. The confidentiality (C:H) and availability (A:H) impacts in the NVD vector are not supported by the facts - the real impact is integrity of the emitted CSV, where a numeric-looking field containing a newline can terminate a record early and inject attacker-controlled rows into a downstream consumer. The low-risk corroborating signals dominate: EPSS is 0.19% (8th percentile), there is NO CISA KEV listing (not actively exploited), and no public exploit code was provided - only the vendor patch/commit and advisories. So despite the headline 9.8, this is best treated as a high-CVSS-but-moderate-real-risk library defect: dangerous for specific applications that serialize attacker-influenced, numerically-validated data to CSV, but not a drop-everything internet-wide emergency. Priority should be driven by whether your Perl applications use Text::CSV_XS combine()/print() on fields that pass through numeric operations before serialization.

A Perl web application validates a user-supplied quantity field with a numeric check (e.g. $qty > 0), which causes Perl to set the numeric flag on the string "12\n"; the application then serializes the record with Text::CSV_XS combine() in its default binary mode. Because the vulnerable code decides quoting from the numeric flag rather than the bytes, the embedded newline is written unquoted, splitting one logical record into two and injecting an attacker-controlled row into the exported CSV. No public exploit code was provided, and this is not RCE - it is CSV record injection against applications following this validate-then-serialize pattern.