Please report security issues privately via GitHub's private vulnerability reporting rather than opening a public issue. I'll aim to respond within a few days.

sucher opens files you point it at and, for some formats, shells out to local tools (pdftocairo, pdftotext, ffmpeg, ffprobe). External commands are invoked with arguments passed directly, never through a shell, so file names cannot inject commands.

Treat untrusted documents with the same caution as any viewer: a malicious file exercises the upstream parsers (image, calamine, poppler, ffmpeg, etc.). Opening links from a markdown document hands the URL to your OS default handler.