Executive brief
ChatterBot, a Python library for creating conversational agents, is vulnerable to a local file system attack. An attacker with local access to the machine can redirect the library's data extraction process to an unauthorized location by planting a symbolic link. This could allow the attacker to write arbitrary files to sensitive directories, potentially leading to data corruption or unauthorized system changes.
Technical details
The `UbuntuCorpusTrainer.extract()` method in ChatterBot uses a predictable output directory (`~/ubuntu_data/ubuntu_dialogs`) and a check-then-create (TOCTOU) pattern. A local attacker can pre-plant a symbolic link at this predictable path. Because `os.path.exists()` follows symlinks, the application skips directory creation and proceeds to call `tar.extractall()`. While the library includes a `safe_extract` function to prevent Zip-Slip (path traversal via archive members), it fails to validate if the base destination directory itself is a symlink. This allows an attacker to redirect the extraction of archive contents to any directory they have permissions to write to. The vulnerability is addressed in version 1.2.14.
Affected products
- gunthercox ChatterBot <= 1.2.13
Timeline
- 2026-06-19: advisory: GitHub Advisory GHSA-wvrh-2f4m-924v published.
- 2026-06-19: patched: Version 1.2.14 released.