CVE-2026-67196 is a cross-site scripting vulnerability in perspective-dev's Perspective product, specifically in the Debug plugin of version 5.0.0 and earlier. The vulnerability occurs because table cell values containing unescaped HTML markup are directly assigned to innerHTML during CSV serialization rendering. Attackers can exploit this by injecting unquoted attribute payloads with event handler attributes that bypass RFC 4180 quoting, as angle brackets and event handler attributes are not escaped. This leads to execution of arbitrary scripts in the origin of the embedding page.

Successful exploitation allows an attacker with low privileges and user interaction to execute arbitrary JavaScript in the context of the affected web page. This can lead to actions such as session hijacking or unauthorized actions within the user's session. The CVSS 4.0 score rates this vulnerability as medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the Debug plugin with untrusted input or disable it if possible. Monitor vendor channels for updates and apply patches promptly once released.