EUVD-2026-52693
GHSA-4hrp-pjm9-fv3q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L because table write access is required; UI:R for victim to view Debug output; S:C because script executes in the embedding page origin; no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.
AnalysisAI
Cross-site scripting in Perspective 5.0.0's built-in Debug plugin enables an authenticated attacker with low privileges to inject arbitrary HTML and JavaScript into the embedding page's origin by writing crafted table cell values that bypass RFC 4180 quoting. The Debug plugin's CSV serialization renderer assigns table cell content directly to innerHTML without sanitization, meaning event handler attributes and unquoted injection payloads execute as script in any page embedding the component. A publicly available proof-of-concept exists; the vulnerability is not listed in CISA KEV, but the low attack complexity and available exploit code elevate practical risk above the moderate CVSS 4.0 score of 5.1.
Technical ContextAI
Perspective (CPE: cpe:2.3:a:perspective-dev:perspective:*:*:*:*:*:*:*:*) is a high-performance streaming analytics and data visualization library targeting browser and Node.js environments. The vulnerable component is the built-in Debug plugin, which serializes tabular data to CSV for display. During rendering, cell values are interpolated directly into innerHTML rather than through safe DOM APIs such as textContent or a sanitizer, constituting a stored or reflected DOM-based XSS (CWE-79: Improper Neutralization of Input During Web Page Generation). The quoting logic follows RFC 4180 for commas and double-quotes but never escapes angle brackets or HTML attribute syntax, allowing payloads such as unquoted event handler attributes (e.g., onmouseover=alert(1)) to survive CSV tokenization and be parsed as live HTML. Because the injection lands in the embedding page's context rather than an isolated frame, the scope change noted in the CVSS vector is accurate - script executes with the full origin privileges of the host application.
RemediationAI
Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/perspective-xss-via-debug-plugin-innerhtml-interpolation and the researcher's multi-CVE disclosure at https://christbowel.com/blog/perspective-5-0-0-five-cves/ to identify the exact patched release; no specific fix version is independently confirmed in the available data, so treat this as 'patch available per vendor disclosure - verify version with perspective-dev release notes.' As an immediate compensating control, disable or restrict access to the Debug plugin in production deployments, as the plugin's intended use is debugging rather than end-user functionality - removing it from the exposed build eliminates the attack surface entirely with no functional impact to normal users. Where disabling is not feasible, restrict the Debug plugin to trusted internal users only and ensure untrusted data cannot populate tables rendered by the Debug plugin. Content Security Policy headers restricting inline script execution (script-src without 'unsafe-inline') will limit but not eliminate XSS impact, as event handler attributes may still fire depending on CSP policy strictness.
More in Perspective
View allPerspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions and c
Remote unauthenticated file disclosure in perspective-dev/perspective 5.0.0 allows any network attacker to read arbitrar
Unauthenticated remote denial-of-service in Perspective 5.0.0 crashes the server process by exploiting missing field val
Remote code execution in Perspective 5.0.0 exposes any network-reachable PolarsVirtualServer backend to arbitrary OS com
Denial of service in Perspective 5.0.0 allows low-privileged remote attackers to render the server permanently unrespons
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today