Is CVE-2026-121691 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121691 being exploited in the wild.

How severe is CVE-2026-121691?

Informational severity, published 10 November 2026.

Is there a fix for CVE-2026-121691?

Yes: fixed in whatstk 0.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121691 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121691?

Check whether you run Whatstk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121691: whatstk ZIP loader improper compression handling

CVE-2026-121691 · Severity: info · Published 2026-11-10

whatstk is a Python library that parses WhatsApp chat exports. A vulnerability in its ZIP loader allows an attacker to provide a malicious chat export file that causes the application to consume massive amounts of memory and disk space, potentially crashing the process. An attacker who can supply a chat file (the native export format on iOS) can trigger a denial-of-service condition.

Quick answers

Is CVE-2026-121691 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121691 being exploited in the wild.
How severe is CVE-2026-121691?: Informational severity, published 10 November 2026.
Which products and versions are affected?: Whatstk 0.7.0 before 0.9.0.
Is there a fix for CVE-2026-121691?: Yes: fixed in whatstk 0.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121691 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121691?: Check whether you run Whatstk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: whatstk 0.9.0

Technical details

The vulnerability is improper handling of highly compressed data (CWE-409) in the ZIP loader. The _str_from_file() function calls zip.extractall() without bounds on member size or compression ratio checks, then reads extracted files in full. While a guard checks for exactly one extracted file, this occurs after extractall() has already written files to disk. Peak memory consumption becomes a multiple of decompressed text size due to intermediate copies during text normalization with unicodedata.normalize("NFKD").

Affected products

whatstk 0.7.0 before 0.9.0

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.