========================================================================
CVE-2026-110757                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110757

  Distribution:  Text-CSV_XS
      Versions:  before 1.65
      MetaCPAN:  https://metacpan.org/dist/Text-CSV_XS
      VCS Repo:  https://github.com/cpan-authors/Text-CSV_XS

Text::CSV_XS versions before 1.65 for Perl allow record splitting by
writing strings used as numbers without quotes in combine

Description
-----------
Text::CSV_XS versions before 1.65 for Perl allow record splitting by
writing strings used as numbers without quotes in combine.

combine and print do not check whether a field needs quotes when its
value has Perl's integer or numeric flag set. Perl sets these flags on
a string used in a numeric operation when it parses as a number, which
allows leading and trailing whitespace. With binary set, as csv does by
default, "12\n" passes a check such as $qty > 0 and is then written
unquoted with its newline.

A value validated as a number can end the record early and turn the
fields after it into a separate row.

Problem types
-------------
- CWE-116 Improper Encoding or Escaping of Output

Solutions
---------
Upgrade to Text-CSV_XS 1.65 or later.

References
----------
https://github.com/cpan-authors/Text-CSV_XS/commit/fcfb796cb50de9cef8b94a70535304ac41a50c56.patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes

Timeline
--------
- 2026-10-14: Fix committed to upstream repository.
- 2026-10-15: Version 1.65 released with fix.