CVE-2026-110757

Executive Summary

CVE-2026-110757 is an improper output encoding vulnerability (CWE-116) in the Perl module Text::CSV_XS affecting all versions before 1.65. The combine and print routines fail to quote fields whose values carry Perl's integer or numeric flag, so strings that parse as numbers but contain leading or trailing whitespace—including newline characters—are written unquoted. An attacker who can supply a value that an application first validates as numeric and then writes into a CSV record can terminate the record early and inject arbitrary additional rows (CSV/record injection), corrupting downstream consumers such as spreadsheets, importers, and data-pipeline parsers. The flaw is unpatched per tracked sources (no patch evidence, Patch Confidence 0/4), has no public PoC, is not in CISA KEV, and has not yet been scored by FIRST.org (EPSS not available).

Technical Analysis

Text::CSV_XS is a widely used Perl library for parsing and generating CSV data. Its combine method assembles an array of fields into a single CSV record, and print writes that record to a filehandle. Both routines are responsible for deciding, per field, whether the value must be enclosed in quotes.

The core defect is an optimization that trusts Perl's internal scalar flags. When a Perl string has been used in a numeric context (for example, a comparison such as $qty > 0), the interpreter sets the integer or numeric flag on that scalar. The library checks whether the value "is a number" via these flags and, if so, skips quoting. The problem is that Perl's numeric parsing of a string tolerates leading and trailing whitespace, so a value like "12\n" passes a numeric validation and carries the numeric flag. Critically, when the string's binary flag is set—which is the default behavior of the csv module—the newline is preserved rather than normalized away.

As a result, combine and print write 12\n unquoted. In a CSV record, an unquoted newline is a record terminator (RFC 4180 semantics). Everything the attacker placed after the newline is therefore interpreted by any conforming CSV consumer as a new record, and the fields that legitimately follow the vulnerable field become part of that injected row. This is an integrity violation: validated data structure is silently altered at serialization time, even though the application performed input validation.

The attack surface is any application, reporting pipeline, import/export job, or data-export API that (1) accepts user-influenced strings, (2) validates them as numeric, and (3) emits them through Text::CSV_XS combine/print without additional sanitization. The precondition that the field be treated as numeric reduces the population of directly exploitable fields but does not eliminate it—quantities, prices, IDs, ratings, coordinates, and counters are common numeric fields in CSV exports.

CWE-116 (Improper Encoding or Escaping of Output) is the correct classification: the library produces output that is structurally ambiguous because it fails to escape delimiter-significant characters in a field it believes to be safe. The flaw is a library-level encoding decision error rather than a memory-safety issue; there is no code execution primitive inherent to the defect, but the corrupted output is the injection vector for downstream consumers. Specific internal function symbols and code paths beyond the documented combine and print methods are not available from the supplied description; the mechanism above is derived strictly from the NVD narrative.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the documented behavior. 1) Reconnaissance: the attacker identifies features that export data to CSV—report generators, billing/inventory exports, admin data dumps—and notes which fields accept numeric-looking input and are reflected into the export (quantities, IDs, prices). 2) Triggering the flaw class: the attacker submits a value that satisfies the application's numeric validation (e.g., a digit string with an embedded or trailing newline) so that Perl sets the numeric/binary flags; the application stores it as "validated numeric data." 3) Payload writing: when the export runs, combine/print writes the field unquoted; the embedded newline ends the record and injects additional comma-separated fields, allowing the attacker to fabricate entire rows in the output. 4) Post-exploitation impact: the injected rows are consumed by downstream tools—spreadsheet imports (potential formula injection when opened), automated reconciliation, ERP ingestion, or security log pipelines—causing data integrity loss, mis-recorded financial or inventory figures, or confusion of automated processing. The attacker does not gain direct unauthorized execution via this CVE; impact is integrity-based and amplified by trust in the "validated numeric" field.

Impact Assessment

Business impact centers on data integrity and downstream trust: corrupted CSV exports can propagate into billing, inventory, reporting, and analytics systems, and injected rows may be interpreted as legitimate records. Using the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, the attack is network-reachable but requires a specific precondition (user-controlled value with numeric flag and whitespace/newline, plus a consumer that parses the output), giving High attack complexity; there is no confidentiality or availability impact, but integrity impact is High. Blast radius is broad: Text::CSV_XS is a foundational library used across countless Perl applications and pipelines, so many services may transitively rely on it even if they never call it directly. Because the flaw is unpatched per tracked sources, exposure persists until the operator upgrades to 1.65 or later.

Detection Guidance

Sigma Rule

title: Potential CSV Record Injection via Numeric Field (Text::CSV_XS < 1.65)
id: 8f2c1a4e-cve-2026-110757
status: experimental
description: Detects CSV export input fields containing embedded newline characters in numeric fields, consistent with record-splitting attempts against Text::CSV_XS
logsource:
  category: webserver
detection:
  selection:
    cs-method:
      - 'POST'
      - 'PUT'
  kw_newline:
    - '|0a|'
    - '|0d|'
  field:
    - 'qty'
    - 'quantity'
    - 'price'
    - 'amount'
    - 'id'
    - 'count'
  condition: selection and kw_newline and field
falsepositives:
  - Legitimate multi-line free-text fields
level: medium

YARA Rule

rule CVE_2026_110757_Text_CSV_XS_NumericFlag_NoQuote
{
    meta:
        description = "Detects CSV output with unquoted numeric fields containing embedded newlines (Text::CSV_XS < 1.65 record splitting)"
        cve = "CVE-2026-110757"
        author = "valtersit.com"
        date = "2026-01-01"
    strings:
        $numeric_newline = /[[:space:]]*[0-9]+[ \t]*[\r\n][^"\r\n]*,[^"\r\n]*/
    condition:
        $numeric_newline
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110757 Text::CSV_XS numeric field newline injection attempt"; flow:to_server,established; content:"POST"; http_method; pcre:"/(?:qty|quantity|price|amount|id|count)=[0-9]+%0[ad]/iU"; reference:cve,2026-110757; classtype:web-application-attack; sid:2026110757; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [any where event.category == "web" and http.request.method in ("POST","PUT") and
     wildcard(http.request.body.content, "*qty=*") and
     (wildcard(http.request.body.content, "*%0a*") or wildcard(http.request.body.content, "*%0d*"))]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=http
| eval body=coalesce(form_data, uri_query)
| where match(body, "(?i)(qty|quantity|price|amount|id|count)=") AND (match(body, "%0a") OR match(body, "%0d"))
| stats count values(uri_path) as paths by src_ip
| where count > 0

Wazuh OSSEC Rule

<group name="web,csv_injection,">
  <rule id="2026110" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <regex type="pcre2">(?i)(qty|quantity|price|amount|id|count)=[0-9]+%0[ad]</regex>
    <description>Possible CVE-2026-110757 CSV record injection via numeric field newline</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). 1) Immediate mitigations: upgrade Text::CSV_XS to version 1.65 or later where feasible; when upgrade is not immediately possible, sanitize values before serialization—strip or reject leading/trailing whitespace and control characters from fields validated as numeric, and force quoting of all output fields (disable the numeric-flag quoting optimization at the application layer). Treat CSV output as untrusted and re-validate row field counts on the consuming side. 2) Patch/upgrade steps: pin Text::CSV_XS >= 1.65 in dependency manifests, verify with perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION', rebuild container images, and prioritize services that export user-influenced numeric fields. 3) Long-term hardening: enforce output encoding policies at the serialization boundary rather than relying on input validation; add tests asserting that tabular exports quote any field containing whitespace/newlines; and inventory all applications transitively depending on Text::CSV_XS that may layer other CSVs over it.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-110757
• Text::CSV_XS on CPAN: https://metacpan.org/pod/Text::CSV_XS
• CWE-116 Improper Encoding or Escaping of Output: https://cwe.mitre.org/data/definitions/116.html
• CISA KEV catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored): https://www.first.org/epss/