Text::CSV_XS for Perl: Improper handling of trailing CR returns 0xFF byte
Summary
Text::CSV_XS for Perl versions before 1.65 can insert a byte 0xFF that is not present in the input into the last field when parsing input that ends with a separator followed by a lone carriage return (CR). With binary mode enabled, the field contains the lone byte, and for UTF-8 flagged input it becomes malformed UTF-8. An attacker who can supply CSV data to an application using the module can corrupt the parsed data, which may affect imports, validation or billing; the CVSS vector suggests no privileges or user interaction are needed, but this depends on whether untrusted input reaches the parser.
Affected
- Text-CSV_XS versions before 1.65 for Perl
Fixed in
- Text-CSV_XS 1.65 or later (upstream fix in commit 7627f1a2)
- Distribution packages: check your distribution's advisory, as the status differs between distributions
Workaround
- Unknown. No vendor-documented workaround was found.
- Analyst suggestion: strip trailing CR characters from input before parsing and check for stray 0xFF bytes in parsed fields until patched.
Exploitation
- No exploitation in the wild was reported in any source reviewed.
- VulDB reports no exploit is available but technical details are known.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all Perl systems that use Text::CSV_XS, including OS-packaged copies.
- Upgrade to Text::CSV_XS 1.65 or later, or to your distribution's patched build.
- Test CSV import jobs with empty last fields and CRLF input.
- Prioritise internet-facing or partner-facing CSV imports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream fix commit 7627f1a2 (patch) github.com
- Text-CSV_XS 1.65 changes (MetaCPAN) metacpan.org
- CPAN Security Group announcement lists.security.metacpan.org
- Ubuntu security status ubuntu.com
- OSV Debian record osv.dev
- VulDB entry vuldb.com
- Tenable CVE record www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:34.
Original description (NVD)
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker in the field as the byte 0xFF. With binary set, parse("a,\r") returns the fields "a" and "\xFF". On UTF-8 flagged input the last field is a UTF-8 flagged string holding that lone byte, which is malformed UTF-8. The same input with a non-empty last field is rejected as an error. A CRLF file read line by line and chomped ends this way when its last column is empty, so the application receives a byte that is not in its input.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.