Record Splitting Vulnerability in Text::CSV_XS for Perl by HMBRAND

CVE-2026-110757

What is CVE-2026-110757?

The Text::CSV_XS module for Perl has a vulnerability that allows for improper record splitting when handling numeric strings. Specifically, when a field's value is recognized as a number, there is insufficient checking for necessary quotes during the combine process. As a result, strings that should be quoted—such as those with leading or trailing whitespace—can be written to output unquoted. This can lead to early termination of records, creating unforeseen consequences such as separating fields into different rows, which compromises data integrity.

References