# CVE-2026-121691: whatstk ZIP loader improper compression handling

Source: https://junglewise.ai/threats/cve-2026-121691-improper-handling-of-highly-compressed-data-cwe-409-in-the-zip  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-121691 · Severity: info · Published 2026-11-10

whatstk is a Python library that parses WhatsApp chat exports. A vulnerability in its ZIP loader allows an attacker to provide a malicious chat export file that causes the application to consume massive amounts of memory and disk space, potentially crashing the process. An attacker who can supply a chat file (the native export format on iOS) can trigger a denial-of-service condition.

## Quick answers

**Is CVE-2026-121691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121691 being exploited in the wild.

**How severe is CVE-2026-121691?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** Whatstk 0.7.0 before 0.9.0.

**Is there a fix for CVE-2026-121691?** Yes: fixed in whatstk 0.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121691 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121691?** Check whether you run Whatstk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in whatstk 0.9.0

## Technical details

The vulnerability is improper handling of highly compressed data (CWE-409) in the ZIP loader. The _str_from_file() function calls zip.extractall() without bounds on member size or compression ratio checks, then reads extracted files in full. While a guard checks for exactly one extracted file, this occurs after extractall() has already written files to disk. Peak memory consumption becomes a multiple of decompressed text size due to intermediate copies during text normalization with unicodedata.normalize("NFKD").

## Affected products

- whatstk 0.7.0 before 0.9.0

## Timeline

- 2026-11-10: disclosed

## References

- [https://pypi.org/](https://pypi.org/)
- [https://github.com/lucasrodes/whatstk/commit/01d66d8](https://github.com/lucasrodes/whatstk/commit/01d66d8)