Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110757— Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine

Quick assessment

Affected
CVE-2026-110757
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Text::CSV_XS 模块在 1.65 版本之前存在漏洞：当 操作将用作数字的字符串以无引号形式写入时，可能导致记录被错误拆分。 和 函数未检查字段值在设置了 Perl 的整数或数值标志时是否需要添加引号。Perl 会在字符串参与数值运算且能被解析为数字时自动设置这些标志，而该解析过程允许字符串包含前导和尾随空白字符。由于 CSV 默认启用二进制模式，类似 的字符串能通过诸如 的数值验证，随后以无引号形式写入，从而将换行符直接输出到 CSV 数据中。 一旦某个字段值被验证为数字，其中的换行符可能导

AI Predicted 5.3 Difficulty: Easy EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

I. Basic Information for CVE-2026-110757

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine
Source: CVE Program / CVE List V5
Vulnerability Description
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, "12\n" passes a check such as $qty > 0 and is then written unquoted with its newline. A value validated as a number can end the record early and turn the fields after it into a separate row.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对输出编码和转义不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.65 -

II. Public POCs for CVE-2026-110757

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110757

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110757 (1)

Other References for CVE-2026-110757 (1)

IV. Related Vulnerabilities

Same weakness: CWE-116

V. Comments for CVE-2026-110757

No comments yet

Leave a comment