{"id":"CVE-2026-110757","title":"Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine","summary":"Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.\n\ncombine and print do not check whether a field needs quotes when its value has Perl's integer or numeric fla…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-116","CWE-93"],"vendor":"Red Hat","product":"Text-CSV_XS","affected":["Text-CSV_XS < 1.65"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-20T18:28:23.098695Z"},"published":"2026-10-16","updated":"2026-10-20","sourceUpdated":"2026-10-20T18:28:25.925Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110757","references":[{"url":"https://github.com/cpan-authors/Text-CSV_XS/commit/fcfb796cb50de9cef8b94a70535304ac41a50c56.patch"},{"url":"https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110757.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-110757"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554504"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110757"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110757"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00407,"epssPercentile":0.34792,"scores":{"adp":9.8,"vendor":5.3},"ingestedAt":"2026-10-16T22:54:45.849Z","slug":"CVE-2026-110757","body":"## Overview\n\nText::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine.\n\ncombine and print do not check whether a field needs quotes when its value has Perl's integer or numeric flag set. Perl sets these flags on a string used in a numeric operation when it parses as a number, which allows leading and trailing whitespace. With binary set, as csv does by default, \"12\\n\" passes a check such as $qty > 0 and is then written unquoted with its newline.\n\nA value validated as a number can end the record early and turn the fields after it into a separate row.\n\n## Affected\n\n- `Text-CSV_XS < 1.65`\n\n## Remediation\n\nUpgrade to Text-CSV_XS 1.65 or later.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-110757.json)","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":226078,"id":"CVE-2026-110757","ts":1792523846476,"field":"cvss","old":"5.3","new":"9.8"},{"seq":226077,"id":"CVE-2026-110757","ts":1792523846476,"field":"severity","old":"medium","new":"critical"},{"seq":223707,"id":"CVE-2026-110757","ts":1792238373263,"field":"cvss","old":null,"new":"5.3"},{"seq":223706,"id":"CVE-2026-110757","ts":1792238373263,"field":"severity","old":"none","new":"medium"}]}