The vulnerability resides in Text::CSV_XS's combine routine, which does not enforce quoting for fields that have Perl's numeric flag set. When a string that parses as a number contains a newline, Perl treats it as numeric and allows the newline to pass a check such as $qty > 0, causing the field to be written without quotes. The newline then terminates the current record, and any remaining text on that line is interpreted as a new CSV row. This record splitting can corrupt data streams, mislead applications that consume the CSV, or allow an attacker to inject unintended data into subsequent rows. The flaw is a classic example of improper handling of input encoding (CWE-116).

The defect affects all releases of Text::CSV_XS older than version 1.65. Users who depend on the module for generating or consuming CSV data in Perl applications are at risk, particularly when numeric values may include whitespace or newline characters. The advisory covers the core CPAN distribution; no specific vendor product beyond the Perl module is listed.

No EPSS score or KEV listing is available, and the CVE does not provide a CVSS rating. Nonetheless, the flaw permits an attacker with the ability to supply input to the combine function to split records arbitrarily, potentially undermining data integrity or facilitating injection of malicious rows into downstream systems. Because the attack only requires crafted input to the CSV generation routine, it can be executed without elevated privileges if the attacker can influence the data source.