Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121564— Silent loss of messages when merging overlapping chat exports in whatstk

Quick assessment

Affected
lucasrodes whatstk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 库（版本 0.3.0 至 0.9.0 之前）的 文件中， 函数存在“缺失因子的不完整比较”漏洞（CWE-1023），该函数可通过 被调用。此漏洞允许提供聊天导出文件的参与方导致合并后的输出中缺失部分消息，且系统不会发出任何移除提示。 漏洞成因在于：合并逻辑会保留第一条消息时间最早的整个聊天记录，并仅从另一条记录中追加严格晚于前者最后一条消息时间的消息。因此，第二条聊天记录中所有落在第一条记录已覆盖时间范围内的消息均会被丢弃。由于两条聊天记录仅依据时间范围进行比较，而未基于单条消息的唯一身份进行比对，因此只要某条

CVSS 1.8 · Low EPSS 0.34% · P28

Affected Version Matrix 1

VendorProduct Version RangeStatus
lucasrodes whatstk 0.3.0< 0.9.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121564

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Silent loss of messages when merging overlapping chat exports in whatstk
Source: CVE Program / CVE List V5
Vulnerability Description
Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
缺失要素致使对比不完全
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
lucasrodes whatstk 0.3.0 ~ 0.9.0 -

II. Public POCs for CVE-2026-121564

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121564

请登录查看更多情报信息。

Other References for CVE-2026-121564 (4)

IV. Related Vulnerabilities

Same product: whatstk
Same vendor: lucasrodes
Same weakness: CWE-1023