CVE-2026-41958

MediumCVSS 6.5

Published: 07/10/2026(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Summary

A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (dev version, commit 38b21f78). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability.

Risk Assessment

Risk of arbitrary file write on the server, potentially leading to system compromise or modification of critical files.

Recommendation

Update VisiData to the latest patched version or avoid opening .zip files from untrusted sources.

Other vulnerabilities in VisiData

CVE-2026-42532Medium
A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version dev, commit 38b21f78). A specially crafted .eml file can lead to arbitrary file write, which an attacker can trigger by providing a malicious file.

Original NVD description (English source)

A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS