CVE-2026-41958 PUBLISHED

Assigner: talos
Reserved: 29.04.2026 Published: 07.10.2026 Updated: 07.10.2026

A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	visidata
Product	visidata
Versions	Default: unaffected Version dev (commit 38b21f78) is affected

Credits

Discovered by Claudio Bozzato of Cisco Talos

References

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2414

Problem Types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE