VisiData EUVD-2026-94321

Exploitation requires the target to use VisiData's unzip_http RemoteZipFile extract functionality and to open/extract an attacker-supplied crafted .zip file reached via an attacker-provided URL - the feature must be actively invoked by the victim. The primary limiting factors are: required user interaction (the victim must open the malicious remote archive and perform an extract), and that the finding is tied specifically to the development commit 38b21f78, so users on other releases may not be affected. There is no authentication barrier for the attacker (they merely supply the URL/archive), but no remote server component is exposed - the trigger is client-side within the user's VisiData session.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 6.5) indicates a network-reachable, low-complexity, unauthenticated flaw whose severity is capped by two factors: it requires user interaction (UI:R) and affects only integrity (I:H via arbitrary file write), with no confidentiality or availability impact. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV (no active-exploitation signal), and no public exploit was indicated in the supplied data - so this is credible-but-theoretical rather than an in-the-wild threat. The strongest trust signal is that it was reported by Cisco Talos, a reputable research group, which raises confidence in the technical finding even though no independent POC was supplied. Important caveat: the affected version is listed only as a development commit (dev, 38b21f78), not a tagged release, so real-world exposure of production users is uncertain and the CPE wildcard (visidata:*) likely overstates the range of genuinely affected versions - verify the exact fixed/affected versions with the Talos advisory and the VisiData maintainers. An arbitrary file write can escalate to code execution if an attacker overwrites a startup script or config, which should be weighed when prioritizing.

An attacker hosts or links a specially crafted .zip archive and lures a VisiData user into opening it via the unzip_http RemoteZipFile feature (e.g., by providing a crafted URL). When the user extracts a file, path traversal entries in the archive cause VisiData to write attacker-controlled content outside the intended directory, potentially overwriting sensitive files or dropping executable/startup scripts. No public exploit code was identified in the provided data, and the attack hinges on the victim actively opening the attacker-supplied resource.