Executive brief
ChatterBot is a software library used to build conversational AI and chatbots. A security flaw in how it handles training data allows a local attacker to trick the system into writing files to unintended locations on the computer. This could lead to the exposure of sensitive information or unauthorized access to system files if an attacker pre-places a malicious link on the machine.
Technical details
The vulnerability exists in the `UbuntuCorpusTrainer.extract()` method, which uses a predictable home-rooted directory (`~/ubuntu_data/ubuntu_dialogs`) for data extraction. The implementation uses a 'check-then-create' pattern (`os.path.exists`) that follows symbolic links; if an attacker creates a symlink at this predictable path, the application skips directory creation and extracts archive contents through the symlink. While the library includes 'Zip-Slip' protection for archive members, it fails to validate the base output directory itself. This allows a local attacker to perform an arbitrary write to any directory they have permissions for, potentially overwriting configuration files or planting malicious scripts. The issue is fixed in version 1.2.14 by ensuring the output path is not a symbolic link.
Affected products
- gunthercox ChatterBot < 1.2.14
Timeline
- 2026-06-19: patched: Fix merged into master branch and version 1.2.14 released.
- 2026-07-09: disclosed: CVE-2026-58198 published.