CVE-2026-121564
Deferred Deferred - Pending Action

Incomplete Message Comparison in whatstk Library

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Secur0

Description
Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121564
EUVD
EUVD-2026-115913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lucasrodes whatstk 0.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1023 The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121564 is a vulnerability in the whatstk library's merge_chats() function where merging WhatsApp chat exports silently discards messages if their timestamps fall within the date range of the other export. This happens because the function compares date ranges rather than individual message identities, leading to potential data loss without warning. The issue affects versions 0.3.0 to 0.8.1 and is classified under CWE-1023.

Detection Guidance

This vulnerability is specific to the whatstk library and affects the merge_chats() function in versions 0.3.0 to 0.8.1. To detect it, check the installed version of whatstk using pip show whatstk. If the version is below 0.9.0, the system is vulnerable. No network commands are needed as this is a local library issue.

Impact Analysis

This vulnerability can cause loss of critical messages during chat merging, which may affect forensic reviews or training datasets. Since the merged result omits messages without indication, users relying on complete chat records may make incorrect conclusions. The impact is limited to local access and requires active user interaction to trigger the merge.

Mitigation Strategies

Upgrade the whatstk library to version 0.9.0 or later using pip install --upgrade whatstk. This version fixes the message loss issue during chat merging. If upgrading is not possible, avoid using the merge_chats() function until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121564. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...