CVE-2026-42532: VisiData Path Traversal Vulnerability

CVE-2026-42532 Overview

CVE-2026-42532 is a path traversal vulnerability [CWE-22] in the EmailSheetextract_parts functionality of VisiData, affecting the development build at commit 38b21f78. A specially crafted .eml file can trigger arbitrary file write when parsed by VisiData. The attacker supplies a malicious email file that the victim opens in VisiData, and the extraction routine writes attachment contents to attacker-controlled paths outside the intended directory.

Critical Impact

Arbitrary file write through a malicious .eml file can overwrite configuration files, scripts, or user-owned files, enabling local code execution or persistence.

Affected Products

• VisiData (interactive terminal multitool for tabular data)
• Development branch at commit 38b21f78
• Any downstream build incorporating the vulnerable EmailSheet.extract_parts code path

Discovery Timeline

• 2026-10-07 - CVE CVE-2026-42532 published to NVD
• 2026-10-07 - Last updated in NVD database
• Vulnerability report published as TALOS-2026-2415

Technical Details for CVE-2026-42532

Vulnerability Analysis

VisiData is a Python-based terminal application for exploring tabular data, including email archives through its EmailSheet loader. The extract_parts function iterates over MIME parts in a .eml file and writes each attachment to disk using the filename declared in the message. The implementation trusts the attachment filename from the untrusted email, which an attacker controls entirely. Writing attacker-chosen content to attacker-chosen paths opens persistence, configuration tampering, and local privilege-adjacent attack chains depending on where VisiData runs.

Exploitation requires user interaction: the victim must open the crafted file in VisiData. The attack vector is local, and the impact is limited to integrity. Confidentiality and availability are not directly affected, though a write primitive can be chained into both.

Root Cause

The root cause is missing path sanitization on MIME attachment filenames before they are joined to the output directory. A filename such as ../../.ssh/authorized_keys or an absolute path resolves outside the intended extraction directory. The vulnerability maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An attacker crafts an .eml file containing one or more MIME parts whose Content-Disposition filename includes directory traversal sequences or an absolute path. The attacker delivers the file through email, a shared drive, or any channel that convinces the victim to open it in VisiData. When the user invokes attachment extraction, extract_parts writes the attachment body to the traversed location with the privileges of the VisiData process.

No verified public exploit code is available. See the Talos Intelligence Vulnerability Report for technical analysis of the vulnerable code path.

Detection Methods for CVE-2026-42532

Indicators of Compromise

• Unexpected files appearing outside a user's intended extraction directory shortly after VisiData opens a .eml file.
• .eml files whose MIME Content-Disposition headers contain ../, ..\, or absolute paths such as /etc/ or C:\.
• New or modified entries in sensitive paths such as ~/.ssh/, ~/.bashrc, ~/.config/, or scheduled task directories following VisiData usage.

Detection Strategies

• Scan .eml files at ingestion for MIME filenames containing traversal sequences or absolute path separators.
• Monitor the VisiData process for file writes outside the current working directory or user's documents tree.
• Correlate .eml opens in VisiData with subsequent writes to home-directory dotfiles or system configuration paths.

Monitoring Recommendations

• Enable filesystem auditing (auditd on Linux, Sysmon FileCreate events on Windows) scoped to shells and interpreters that spawn VisiData.
• Alert on Python child processes writing to credential, SSH, or shell startup files when the parent command line references vd or visidata.
• Log opens of .eml files in forensic data lakes to support retroactive hunts once vulnerable commits are inventoried.

How to Mitigate CVE-2026-42532

Immediate Actions Required

• Avoid opening untrusted .eml files in VisiData builds based on commit 38b21f78 or earlier affected development revisions.
• Run VisiData inside an isolated directory or container when inspecting untrusted email samples.
• Inventory systems where analysts use VisiData for mail triage and restrict .eml sources to trusted mailboxes.

Patch Information

No fixed version is identified in the published advisory at the time of writing. Monitor the Talos Intelligence Vulnerability Report and the VisiData project repository for a patched commit that sanitizes MIME filenames before writing attachments.

Workarounds

• Pre-sanitize .eml files by stripping or renaming attachments with traversal sequences before loading them into VisiData.
• Launch VisiData under a low-privilege account that cannot modify sensitive dotfiles, SSH keys, or system paths.
• Use container or firejail-style sandboxing to confine filesystem writes to a disposable directory.

# Example: open a .eml file inside a confined directory using firejail
mkdir -p /tmp/vd-sandbox && cd /tmp/vd-sandbox
firejail --private=/tmp/vd-sandbox --net=none vd suspicious.eml