Executive brief
Perspective is an interactive analytics and data visualization component used in internal dashboards at financial and trading institutions. A vulnerability in its built-in Debug plugin allows attackers to inject malicious JavaScript by inserting unescaped HTML into table cell values, which are then rendered directly into the page. An attacker with the ability to write data to a table can execute arbitrary code in the context of the embedding page, potentially compromising user sessions and stealing sensitive financial data.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the Debug plugin's CSV serialization rendering. The root cause is the interpolation of user-controlled table cell values directly into the DOM via innerHTML without HTML entity encoding or sanitization. Attackers can craft table rows containing HTML/JavaScript payloads that bypass RFC 4180 CSV quoting rules, since angle brackets and event handler attributes are never escaped. The attack vector is network-based and requires the ability to write a row of data to a table, but does not require authentication or direct server access in chained exploitation scenarios. Once injected, malicious scripts execute with the privileges of the embedding page's origin. A patch has not been mentioned in available sources.
Affected products
- Perspective Perspective 5.0.0
Timeline
- 2026-08-04: disclosed: Public disclosure of CVE-2026-67196
- 2026-07-30: other: Live analysis published detailing five CVEs in Perspective 5.0.0