Cross-Site Scripting Vulnerability in Perspective 5.0.0 by the Vendor
CVE-2026-67196

5.1MEDIUM

Key Information:

Vendor

Perspective-dev

Status
Perspective
Vendor
CVE Published:
4 August 2026

Badges

👾 Exploit Exists

What is CVE-2026-67196?

Perspective version 5.0.0 contains a vulnerability that allows for cross-site scripting attacks via the built-in Debug plugin. This vulnerability enables attackers to inject arbitrary HTML and JavaScript by manipulating table cell values that include unescaped HTML markup. These values are directly interpolated into the innerHTML during CSV serialization rendering, allowing crafted table rows to bypass RFC 4180 quoting rules. Since angle brackets and event handler attributes are not escaped before assignment, this can lead to the execution of malicious scripts within the page's context, posing significant security risks.

Affected Version(s)

perspective 0 <= 5.0.0

References

https://christbowel.com/blog/perspective-5-0-0-five-cves/
technical-descriptionexploit
https://www.vulncheck.com/advisories/perspective-xss-via-...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Christ Bowel Bouchuen
.