CVE-2026-110756 Affecting libtext-csv-xs-perl package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ECHOLATEST-LIBTEXTCSVXSPERL-21173070
- published17 Oct 2026
- disclosed16 Oct 2026
Introduced: 16 Oct 2026
NewCVE-2026-110756 (opens in a new tab)How to fix?
There is no fixed version for Echo:latest libtext-csv-xs-perl.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libtext-csv-xs-perl package and not the libtext-csv-xs-perl package as distributed by Echo.
See How to fix? for Echo:latest relevant fixed versions and status.
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.