CVE-2026-110757: CWE-116 Improper Encoding or Escaping of Output

The vulnerability in Text::CSV_XS prior to version 1.65 arises because the combine and print functions do not verify if a field requires quoting when the field's value has Perl's numeric flag set. Perl sets this flag on strings used in numeric operations, which can include strings with leading or trailing whitespace and newline characters. When such a value (e.g., "12\n") passes numeric checks, it is written unquoted, allowing the newline to split the CSV record unexpectedly. This improper escaping or encoding of output corresponds to CWE-116.

An attacker or malformed input can cause CSV records to be split incorrectly by injecting newline characters into numeric fields that are written without quotes. This can disrupt CSV parsing and data integrity, potentially leading to incorrect data processing or injection of unintended records.

No official patch or fix information is provided in the advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using affected versions or implement input validation to ensure numeric fields do not contain newline characters or leading/trailing whitespace that could cause record splitting.