Visidata
Monthly
Arbitrary file write via path traversal in VisiData's unzip_http RemoteZipFile extraction routine allows an attacker who supplies a crafted .zip archive over a URL to write files outside the intended extraction directory on the victim's machine. The flaw is tied to the development commit 38b21f78 (CWE-22) and is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); no privileges are required on the attacker's side, but the victim must open the attacker-provided remote archive and explicitly invoke the extract functionality. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-priority issue contingent on user interaction rather than an actively exploited emergency.
Path traversal in VisiData's EmailSheet extract_parts functionality lets a specially crafted .eml file write files to arbitrary locations on the filesystem using attacker-controlled filenames, producing a high integrity impact (C:N/I:H/A:N) on data the user account can write. Only the development snapshot identified by commit 38b21f78 is confirmed affected, so exposure is limited to users running that specific dev build rather than a numbered stable release. The CVSS 3.1 vector (5.5, AV:L/AC:L/PR:N/UI:R) describes a local attack with no privileges required but a mandatory user-interaction step: the victim must open the malicious message and invoke extract_parts, and accordingly there is no remote or automated trigger. At time of analysis there is no evidence of confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified, making this a moderate, low-priority issue.
Arbitrary file write via path traversal in VisiData's unzip_http RemoteZipFile extraction routine allows an attacker who supplies a crafted .zip archive over a URL to write files outside the intended extraction directory on the victim's machine. The flaw is tied to the development commit 38b21f78 (CWE-22) and is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N); no privileges are required on the attacker's side, but the victim must open the attacker-provided remote archive and explicitly invoke the extract functionality. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-priority issue contingent on user interaction rather than an actively exploited emergency.
Path traversal in VisiData's EmailSheet extract_parts functionality lets a specially crafted .eml file write files to arbitrary locations on the filesystem using attacker-controlled filenames, producing a high integrity impact (C:N/I:H/A:N) on data the user account can write. Only the development snapshot identified by commit 38b21f78 is confirmed affected, so exposure is limited to users running that specific dev build rather than a numbered stable release. The CVSS 3.1 vector (5.5, AV:L/AC:L/PR:N/UI:R) describes a local attack with no privileges required but a mandatory user-interaction step: the victim must open the malicious message and invoke extract_parts, and accordingly there is no remote or automated trigger. At time of analysis there is no evidence of confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified, making this a moderate, low-priority issue.