Is CVE-2026-121564 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121564 being exploited in the wild.

How severe is CVE-2026-121564?

Informational severity, published 3 November 2026.

Is there a fix for CVE-2026-121564?

Yes: fixed in 0.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121564 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-121564?

Check whether you run Whatstk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121564: whatstk message loss in merge_chats() due to incomplete date comparison

CVE-2026-121564 · Severity: info · Published 2026-11-03

whatstk is a Python library used for parsing and analyzing chat exports, commonly employed in forensic review and training data generation. A flaw in its chat merge function silently discards messages when their timestamps fall within the date range of another chat, even if they are unique to one export. This causes merged chat histories to omit data without warning or indication, potentially compromising forensic analysis or training datasets.

Technologies: Whatstk. Vendors: Whatstk.

Quick answers

Is CVE-2026-121564 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121564 being exploited in the wild.
How severe is CVE-2026-121564?: Informational severity, published 3 November 2026.
Which products and versions are affected?: Whatstk 0.3.0 before 0.9.0.
Is there a fix for CVE-2026-121564?: Yes: fixed in 0.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121564 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-121564?: Check whether you run Whatstk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.9.0

Technical details

The merge_chats() function in whatstk/utils/chat_merge.py compares chat exports by date range rather than individual message identity (CWE-1023), discarding any message from the second chat whose timestamp falls within the first chat's date range. Both branches of _merge_two_chats() exhibit this behavior. An attacker or malicious actor supplying crafted chat exports can exploit this to silently cause message loss, with no warning returned to the user.

Affected products

whatstk whatstk 0.3.0 before 0.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.