CVE-2026-121564— whatstk 合并重叠聊天导出时消息静默丢失漏洞
一分钟漏洞结论
影响对象
lucasrodes whatstk
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 库（版本 0.3.0 至 0.9.0 之前）的 文件中， 函数存在“缺失因子的不完整比较”漏洞（CWE-1023），该函数可通过 被调用。此漏洞允许提供聊天导出文件的参与方导致合并后的输出中缺失部分消息，且系统不会发出任何移除提示。 漏洞成因在于：合并逻辑会保留第一条消息时间最早的整个聊天记录，并仅从另一条记录中追加严格晚于前者最后一条消息时间的消息。因此，第二条聊天记录中所有落在第一条记录已覆盖时间范围内的消息均会被丢弃。由于两条聊天记录仅依据时间范围进行比较，而未基于单条消息的唯一身份进行比对，因此只要某条
影响版本矩阵 1
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| lucasrodes | whatstk | 0.3.0< 0.9.0 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-121564 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Silent loss of messages when merging overlapping chat exports in whatstk
来源: CVE Program / CVE List V5
Vulnerability Description
Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
缺失要素致使对比不完全
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| lucasrodes | whatstk | 0.3.0 ~ 0.9.0 | - |
|
二、漏洞 CVE-2026-121564 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-121564 的情报信息
请登录查看更多情报信息。
CVE-2026-121564 其他参考 (4)
-
https://secur0.com/en/cna/cve-list/cve-2026-121564-whatstk-merge-message-loss third-party-advisory technical-description
IV. Related Vulnerabilities
Same product: whatstk
Same vendor: lucasrodes