CVE-2026-41958: Path Traversal
A path traversal vulnerability exists in the unziphttp RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
VisiData users who open or otherwise trigger RemoteZipFile extraction from an attacker-provided URL are exposed. The attack requires user interaction with the crafted URL.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted .zip file through a URL. No privileges are required, but a user must interact with the supplied URL.
How can I determine whether my installation is affected?
The affected version information identifies the development version at commit 38b21f78. Compare the commit or source revision of the VisiData build in use with that commit.