CVE-2026-41958 Overview
CVE-2026-41958 is a path traversal vulnerability [CWE-22] in the unzip_http module of VisiData, affecting the RemoteZipFile extract functionality at development commit 38b21f78. A specially crafted .zip file retrieved over HTTP can write files outside the intended extraction directory, leading to arbitrary file write on the victim host. An attacker triggers the flaw by providing a crafted URL that VisiData fetches and processes through the vulnerable extract routine.
Critical Impact
Successful exploitation allows attacker-controlled file writes to arbitrary locations on disk, which can be chained into code execution or configuration tampering when a user opens a malicious remote archive.
Affected Products
- VisiData unzip_http RemoteZipFile extract functionality
- VisiData development build at commit 38b21f78
- Downstream tooling that imports unzip_http from this VisiData revision
Discovery Timeline
- 2026-10-07 - CVE-2026-41958 published to the National Vulnerability Database
- 2026-10-07 - Last updated in NVD database
- Technical details published in Talos Intelligence Vulnerability Report TALOS-2026-2414
Technical Details for CVE-2026-41958
Vulnerability Analysis
VisiData is a terminal interface for exploring and manipulating tabular data. Its unzip_http module streams remote ZIP archives over HTTP using HTTP range requests, exposing archive entries through a RemoteZipFile class. The extract functionality writes archive entries to disk using the filename stored inside the ZIP central directory without normalizing or validating that the resulting path remains inside the target directory.
An attacker who controls the archive controls those entry names. By embedding path segments such as ../ or absolute paths in the stored filename, the attacker directs file writes outside the extraction root. Because the user initiates the fetch by supplying a URL, exploitation requires user interaction but no authentication to the target host.
Root Cause
The root cause is missing path sanitization during archive extraction, classified as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The RemoteZipFile extract routine trusts the untrusted filename field in each ZIP entry and concatenates it with the destination directory before opening the output file for write.
Attack Vector
Exploitation proceeds over the network. The attacker hosts a crafted ZIP archive and lures a VisiData user into opening its URL. When VisiData parses the remote archive and invokes the extract code path, each malicious entry resolves to an attacker-chosen filesystem location writable by the VisiData process. Overwriting shell startup files, cron entries, SSH authorized_keys, or Python site-packages typically converts the file write into code execution in the user context. See the Talos Intelligence advisory for a full technical walkthrough.
Detection Methods for CVE-2026-41958
Indicators of Compromise
- Outbound HTTP range requests from a VisiData process to untrusted hosts followed by file creation outside the user's working directory.
- ZIP archives whose central directory entries contain ../ sequences, absolute paths, or drive letters in the filename field.
- Unexpected modifications to sensitive files such as ~/.bashrc, ~/.ssh/authorized_keys, cron tables, or Python package directories shortly after VisiData execution.
Detection Strategies
- Inspect ZIP archives fetched by analyst workstations for entries whose normalized paths escape the archive root.
- Alert on child file-write events from the vd or Python interpreter process targeting paths outside $HOME/Downloads or the current working directory.
- Correlate VisiData process execution with URL arguments pointing to externally hosted .zip resources.
Monitoring Recommendations
- Enable filesystem auditing on sensitive dotfiles, shell init scripts, and scheduler directories for the users who run VisiData.
- Log and review command-line arguments passed to vd to identify remote archive URLs sourced from untrusted locations.
- Baseline network egress from analyst and research hosts so anomalous archive downloads surface quickly.
How to Mitigate CVE-2026-41958
Immediate Actions Required
- Avoid opening remote ZIP archives through VisiData from untrusted or unverified URLs until a fixed release is installed.
- Downgrade from the affected development commit 38b21f78 to a known-good tagged release that does not include the vulnerable unzip_http extract code path.
- Run VisiData under a least-privilege account that cannot modify system files, SSH keys, or scheduler configurations.
Patch Information
No fixed version is identified in the published CVE record at the time of writing. Monitor the Talos Intelligence advisory TALOS-2026-2414 and the VisiData project for a patched release that validates archive entry paths before writing them to disk.
Workarounds
- Download remote ZIP archives separately, inspect their contents with unzip -l, and open only sanitized local copies in VisiData.
- Execute VisiData inside a container or sandbox with a read-only mount of the home directory to contain any arbitrary file write.
- Apply filesystem ACLs or AppArmor/SELinux profiles that restrict the VisiData process to a dedicated working directory.
# Inspect a ZIP for traversal entries before opening it in VisiData
unzip -l suspicious.zip | awk '{print $4}' | grep -E '^(/|.*\.\./)'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.