whatstk merge silently drops messages whose dates overlap another chat
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Versions of the whatstk library from 0.3.0 before 0.9.0 silently drop messages when merging chat exports. The merge compares the two chats by date range rather than by message identity, so any message whose date falls inside the range of the other chat is discarded without warning. A party that supplies the chat exports can cause messages to be absent from the merged output, tracked as CWE-1023. The merged result omits messages that the inputs contain, which matters for forensic review and training data generation.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lucasrodes | whatstk | 0.3.0 to before 0.9.0 | 0.9.0 | Patch available | CNA |
- whatstk Vendorlucasrodes Affected 0.3.0 to before 0.9.0 Fixed in 0.9.0 Patch available CNA
Remediation
whatstk is fixed in version 0.9.0. Upgrade to 0.9.0 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA whatstk (lucasrodes) Fixed in 0.9.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
lucasrodes whatstk 0.9.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-84557 Unescaped header separators in whatstk cause exponential regex backtrackingPriority LOW 29
Timeline
- 2026-11-03 Threatist record created from CVE-2026-121564
- 2026-11-03 Alias added: GHSA-jhwv-p2mf-f4x9
References
More lucasrodes vulnerabilities
- TI-2026-84557 Unescaped header separators in whatstk cause exponential regex backtracking CVSS 4.0MEDIUM 6.7
Sources
- CVE-2026-121564 · CVE Program
- CVE-2026-121564 · NVD
- FIRST EPSS
- GHSA-jhwv-p2mf-f4x9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences