Vulnerability · Published Aug 4, 2026 · Assigned by VulnCheck

CVE-2026-67196Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation

Medium 5.4

In plain English

A medium-severity cross-site scripting in perspective from perspective-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 82.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization rendering. Attackers can craft table rows with payloads such as unquoted attribute injections containing event handler attributes that bypass RFC 4180 quoting, since angle brackets and event handler attributes are never escaped before assignment, causing malicious scripts to execute in the embedding page's origin.

Affected products (as reported)

Vendor	Product	Versions
perspective-dev	perspective	0 – through 5.0.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/perspective-xss-via-debug-plugin-innerhtml-interpolation third-party-advisory