CVE-2026-121564 in whatstk
Summary
by MITRE • 11/03/2026
Incomplete Comparison with Missing Factors (CWE-1023) in merge_chats() (whatstk/utils/chat_merge.py), reached from BaseChat.merge(), in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was removed, because the merge keeps whole the chat whose first message is oldest and appends from the other only the messages that are strictly newer than the last message of the first. Every message of the second chat that falls inside the date range already covered by the first is therefore discarded. The two chats are compared on their date ranges and not on the identity of the individual messages, so a message held by only one of the two exports is dropped whenever its date falls inside the range of the other, and both branches of _merge_two_chats() behave this way. The merged result is returned without a warning and without a count of what was removed. This results in a merged chat that omits messages the inputs contain, in a library whose documented uses include forensic review and the generation of training data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as CWE-1023, Incomplete Comparison with Missing Factors, resides within the merge_chats function located in whatstk/utils/chat_merge.py of the whatstk library versions prior to 0.9.0. This flaw is triggered through the BaseChat.merge() method and represents a critical logic error in how chat exports are combined. The core technical deficiency lies in the algorithm's reliance solely on temporal boundaries rather than unique message identifiers for deduplication or merging decisions. Specifically, the implementation selects one of the two input chats to serve as the base, determined by which contains the oldest first message. It then appends messages from the second chat only if they are strictly newer than the last message recorded in that primary base chat. This approach fundamentally ignores the identity and uniqueness of individual messages within the overlapping date range.
Consequently, any message present in one export but not the other is discarded if its timestamp falls within the temporal span covered by the opposing chat's data set. The logic does not verify whether a specific message instance already exists or check for unique identifiers such as message IDs or hashes. Instead, it assumes that all messages within the overlapping time window are redundant or duplicates of those in the primary chat. This behavior is consistent across both branches of the internal _merge_two_chats() function, ensuring that data loss occurs regardless of which input is prioritized based on date range. The result is a merged output that silently omits valid messages from one of the source files without providing any warning or statistical count of the removed items.
The operational impact of this vulnerability is severe, particularly given the documented use cases for whatstk, which include forensic review and the generation of training data for machine learning models. In forensic contexts, the integrity and completeness of evidence are paramount. The silent omission of messages means that investigators may miss critical pieces of communication, leading to incomplete or biased conclusions about events under investigation. For applications involving AI training data, this flaw introduces significant noise and bias into datasets. Models trained on such merged chats will learn from an artificially truncated view of conversations, potentially affecting their ability to understand context, sentiment, or intent accurately. The lack of transparency regarding what was removed prevents users from auditing the integrity of the processed data, making it impossible to distinguish between intentional filtering and accidental data loss due to this bug.
From a security classification perspective, while not directly exploitable for remote code execution, this vulnerability facilitates data integrity violations that can lead to broader system compromises depending on downstream usage. It aligns with CWE-1023 regarding incomplete comparisons where critical factors such as message identity are ignored in favor of simpler temporal metrics. In the context of the MITRE ATT&CK framework, this behavior could be associated with techniques related to data manipulation or evasion if an attacker were able to supply crafted chat exports designed to hide specific communications within a larger dataset. The absence of validation checks for unique identifiers represents a failure in input validation and logic control that undermines trust in automated processing pipelines.
Mitigation strategies must focus on correcting the merging algorithm to prioritize message identity over simple date range comparisons. Developers should implement deduplication mechanisms using unique message attributes such as timestamps combined with sender IDs or explicit message hashes, rather than relying solely on chronological ordering. Additionally, the merge function should be updated to log and report any discarded messages, providing users with visibility into data transformations. This transparency is essential for forensic applications where audit trails are required. Updating to version 0.9.0 of whatstk resolves this issue by addressing these logical flaws in chat merging operations. Until an upgrade is performed, organizations relying on this library for critical analysis should manually verify merged outputs against source files or implement custom validation layers to detect missing messages before proceeding with further processing steps.