whatstk CVE-2026-121564

Requires a victim to call merge_chats()/BaseChat.merge() on two or more chat exports where at least one is supplied or influenced by the attacker, in whatstk 0.3.0 before 0.9.0. The silent drop occurs only for messages that exist in one export but whose timestamps fall inside the date range already covered by the other export, because the merge keeps the chat with the oldest first message whole and appends from the other only messages strictly newer than the first chat's last message. Limiting factors: exploitation is local and depends entirely on the victim actively performing a merge on attacker-influenced input (AV:L, UI:A); there is no network vector, no code execution, and no confidentiality impact - the sole effect is undetected omission of messages from the merged output.

All supplied decision signals point to low real-world urgency. The input CVSS 4.0 base score is 1.8 (low) with AV:L (local - the attacker's influence is limited to the chat-export files fed to the library), AT:P (a specific condition must hold), UI:A (the victim must actively run the merge), and an impact confined to VI:L (integrity of the merged dataset); VC, VA and all subsequent-system metrics are N. vuln.today assigns the decision label 'monitor', not act_now or emergency. No EPSS score and no KEV entry were provided in the input, and no exploit code is referenced, so there is no public exploit identified at time of analysis - this is a silent-correctness defect, not a remotely weaponizable flaw. The key nuance a raw score hides: although severity is low, the consequence is undetectable data omission in a library whose documented uses include forensic review and training-data generation, so for those specific workflows the integrity impact is more consequential than 1.8 suggests. The 'Information Disclosure' tag conflicts with the evidence - the flaw drops messages (an integrity/data-loss problem) and the CVSS vector records VC:N, so there is no confidentiality impact; treat that tag as suspect.

An analyst building a merged record or training corpus runs whatstk.merge_chats() (via BaseChat.merge()) over two WhatsApp exports, at least one supplied by an adversarial party. Any message unique to that party's export whose timestamp falls inside the date range already covered by the other export is silently discarded, so the merged output omits real messages with no warning and no removed-count. No public exploit code is referenced; a vendor fix exists in v0.9.0.