Perspective 5.0.0 contains a cross‑site scripting vulnerability in the built‑in Debug plugin. The bug allows attackers to inject arbitrary HTML and JavaScript by inserting unescaped markup into table cell values. When those values are serialized to CSV, they are interpolated directly into innerHTML, and event‑handler attributes can be injected without proper quoting or escaping, allowing malicious scripts to execute in the embedding page’s origin.

The vulnerability affects versions of the Perspective application distributed by perspective‑dev, specifically the 5.0.0 release. Any deployment running that exact version is at risk; newer releases are not indicated as affected by the CVE data provided.

The CVSS base score is 5.1, indicating moderate potential impact. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it has not yet been weaponized in the wild. Attackers would need the ability to supply malicious table cell content—likely through the Debug plugin’s interface or an import mechanism—after which the injected script runs with the same privileges as the Perspective UI, potentially exposing data or hijacking sessions. The attack vector is inferred to be a web‑based exploitation of a client‑side flaw, as the payload executes in the context of the page that renders the CSV output.