Read the docs

whatstk merge silently drops messages whose dates overlap another chat

Priority LOW 10CWE-1023Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Versions of the whatstk library from 0.3.0 before 0.9.0 silently drop messages when merging chat exports. The merge compares the two chats by date range rather than by message identity, so any message whose date falls inside the range of the other chat is discarded without warning. A party that supplies the chat exports can cause messages to be absent from the merged output, tracked as CWE-1023. The merged result omits messages that the inputs contain, which matters for forensic review and training data generation.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.

Why it matters now

EPSS 0.0034 27th percentileScored 2026-11-07
Fix Fixed whatstk (lucasrodes): 0.9.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
lucasrodeswhatstk0.3.0 to before 0.9.00.9.0Patch availableCNA
  • whatstk Vendorlucasrodes Affected 0.3.0 to before 0.9.0 Fixed in 0.9.0 Patch available CNA

Remediation

whatstk is fixed in version 0.9.0. Upgrade to 0.9.0 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA whatstk (lucasrodes) Fixed in 0.9.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    lucasrodes whatstk 0.9.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-84557 Unescaped header separators in whatstk cause exponential regex backtrackingPriority LOW 29

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121564
  2. 2026-11-03 Alias added: GHSA-jhwv-p2mf-f4x9

References

  • TI-2026-84557 Unescaped header separators in whatstk cause exponential regex backtracking CVSS 4.0MEDIUM 6.7

Sources