CVE-2026-42532

A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version dev, commit 38b21f78). A specially crafted .eml file can lead to arbitrary file write, which an attacker can trigger by providing a malicious file.

An attacker could write files to arbitrary locations, potentially overwriting important files or achieving code execution. This requires a user to process a malicious .eml file.

Update VisiData to a version containing the fix or avoid processing untrusted .eml files. Consider restricting the privileges of the process handling the files.