CVE-2026-67196 Details
Description
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.
A cross-site scripting (XSS) vulnerability has been identified in Perspective version 5.0.0, specifically within the built-in Debug plugin. This vulnerability allows attackers to inject arbitrary HTML and JavaScript by entering unescaped HTML markup into table cell values. During CSV serialization rendering, these values are interpolated directly into the innerHTML without proper escaping. Attackers can exploit this by crafting table rows with payloads that include unquoted attribute injections with event handler attributes, bypassing RFC 4180 quoting. Since angle brackets and event handler attributes are not escaped before being assigned, malicious scripts can execute in the context of the embedding page's origin.
Users can avoid this vulnerability by explicitly loading a different plugin package that does not have this issue, such as '@perspective-dev/viewer-datagrid', and ensuring that the plugin registry is not empty before rendering.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://christbowel.com/blog/perspective-5-0-0-five-cves/ | [email protected] | BundleTechnical Analysis |
| https://www.vulncheck.com/advisories/perspective-xss-via-debug-plugin-innerhtml-interpolation | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Perspective | <= 5.0.0 (semver) |
CPE
Remediation
| |
| @perspective-dev/viewer | <= 5.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |