Quick answers
- Is CVE-2026-110757 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110757 being exploited in the wild.
- How severe is CVE-2026-110757?
- Informational severity, published 16 October 2026.
- Which products and versions are affected?
- CPAN Text::CSV XS before 1.65.
- Is there a fix for CVE-2026-110757?
- Yes: fixed in 1.65. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-110757 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-110757?
- Check whether you run CPAN Text::CSV XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.65
Technical details
The combine() and print() functions skip quoting checks when Perl's IOK (integer OK) or NOK (numeric OK) flags are set on a scalar value, even though the actual bytes may contain characters that require quoting such as newlines or carriage returns. An attacker or buggy code can trigger this by performing a numeric comparison on a string (e.g., "$qty > 0"), which sets these flags while leaving the original bytes—including leading/trailing whitespace and newlines—unchanged. The unquoted output then allows the embedded newline to end the CSV record prematurely, splitting data across rows.
Affected products
- CPAN Text::CSV_XS before 1.65
Timeline
- 2026-10-16: disclosed