Path Traversal Vulnerability in VisiData by VisiData Team
CVE-2026-41958

6.5MEDIUM

Key Information:

Vendor

Visidata

Status
Visidata
Vendor
CVE Published:
7 October 2026

What is CVE-2026-41958?

A path traversal vulnerability has been identified in the unzip_http RemoteZipFile extract functionality of VisiData. This flaw allows an attacker to exploit specially crafted .zip files to execute arbitrary file write operations. By delivering a malicious URL, the attacker can manipulate file paths, potentially compromising system integrity and exposing sensitive data.

Affected Version(s)

visidata dev (commit 38b21f78)

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Claudio Bozzato of Cisco Talos
.