CVE-2026-42532
Description
A flaw was found in VisiData. A path traversal vulnerability in the EmailSheet attachment extraction feature allows an attacker to write arbitrary files by convincing a user to process a specially crafted email (.eml) file. This flaw enables an attacker to create or overwrite critical files outside the intended destination directory on the local system.
Statement
VisiData’s EmailSheet attachment extraction mishandles attacker-controlled attachment paths in .eml files, allowing a user who opens a crafted email to write or overwrite files accessible to that user outside the chosen extraction directory. Impact is limited by the VisiData process’s UID, SELinux domain, and any container boundary; it does not inherently bypass those controls.
Mitigation
Do not extract attachments from untrusted .eml files until a fix is available. Run VisiData with a dedicated unprivileged account and restrict its writable paths, preferably in a confined environment.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
