CVE-2026-67196

Name of the Vulnerable Software and Affected Versions Perspective version 5.0.0

Description A cross-site scripting issue exists in the built-in Debug plugin. Attackers can inject arbitrary HTML and JavaScript by providing table cell values with unescaped HTML markup. These values are interpolated directly into innerHTML during CSV serialization rendering. By crafting table rows with unquoted attribute injections containing event handler attributes, attackers can bypass RFC 4180 quoting because angle brackets and event handler attributes are not escaped before assignment, leading to script execution within the origin of the embedding page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.