VisiData CVE-2026-42532

Exploitation requires the victim to open a specially crafted .eml file in VisiData and invoke the EmailSheet extract_parts functionality, which writes MIME message parts to disk using attacker-controlled (traversal-containing) filenames. Limiting factors: the attack is local only (AV:L) and depends entirely on user interaction (UI:R) - the victim must actively load the malicious file; there is no remote or automated trigger. The only confirmed affected build is the development commit 38b21f78, so exposure is restricted to users running that specific dev snapshot rather than a stable release.

This is a moderate, low-priority issue rather than an urgent one. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 5.5 MEDIUM) is internally consistent with the description: exploitation is local (AV:L) and requires the victim to open a malicious .eml file in VisiData (UI:R), yielding an arbitrary file write (I:H) with no confidentiality or availability impact. Although PR:N technically means no privileges are needed, the mandatory user interaction and local vector mean this is not remotely weaponizable at scale - it is a file-parsing 'open a malicious document' class bug. No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no signal of active exploitation or available exploit code. The affected version is only 'dev (commit 38b21f78)', a pre-release development snapshot, which further limits real-world exposure. Discovery by Cisco Talos (a credible research source) lends confidence to the technical finding, but absent exploitation signals this should be patched on a normal cycle, not treated as an emergency.

An attacker crafts a malicious .eml file whose MIME part filenames contain path-traversal sequences and delivers it to a victim (e.g., via email or a shared dataset). When the victim opens the file in VisiData and the EmailSheet extract_parts functionality writes out the message parts, attacker-controlled paths cause files to be written outside the intended directory, potentially overwriting configuration or startup scripts. No public exploit was identified at time of analysis, and the attack requires the victim to actively open the crafted file.