Incomplete Comparison Vulnerability in Whatstk by lucasrodes
CVE-2026-121564

1.8LOW

Key Information:

Vendor

Lucasrodes

Status
Whatstk
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121564?

An incomplete comparison vulnerability in Whatstk's merge_chats() function can lead to message loss when merging chat exports. The merging process only retains chats based on the date of their first messages, disregarding individual message identities. This flaw causes messages from the second chat to be omitted if their timestamps fall within the range of the first chat's messages. Consequently, users may receive a merged output without any indication of the missing messages, raising concerns for use cases that involve forensic reviews or training data generation.

Affected Version(s)

whatstk 0.3.0 < 0.9.0

References

https://github.com/lucasrodes/whatstk/pull/185
patch
https://github.com/lucasrodes/whatstk/commit/01d66d8
patch
https://github.com/lucasrodes/whatstk/releases/tag/v0.9.0
release-notes

CVSS V4

Score:
1.8
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Robert Mihaila
Amirreza Fadaeizadeh Bidari
Xoán M. Otero Jorge
DarĂ­o Rivas
Secur0 CNA
Lucas Rodés-Guirao
.