EUVD-2026-42685Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local low-privilege access required (AV:L, PR:L); I:L added over vendor vector because symlink redirect also deposits extracted files into unauthorized directories, constituting a write-anywhere primitive.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by tar.extractall(path=self.data_path), allowing a local attacker who pre-plants a symlink at the predictable path to cause archive contents to be written through the symlink to an attacker-chosen directory. This issue is fixed in version 1.2.14.
AnalysisAI
Symlink-based extraction redirect in ChatterBot prior to 1.2.14 enables a local attacker with standard user privileges to cause training corpus archive contents to be written to an attacker-controlled directory by pre-planting a symlink at the predictable path ~/ubuntu_data/ubuntu_dialogs before UbuntuCorpusTrainer.extract() runs. The check-then-create pattern preceding tar.extractall() creates a CWE-367 TOCTOU window that, on shared multi-user systems, allows the attacker to intercept the extraction target without any race if the symlink is planted before the first training run. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 1.2.14.
Technical ContextAI
ChatterBot (cpe:2.3:a:gunthercox:chatterbot:*:*:*:*:*:*:*:*) is a Python machine learning library for building conversational chatbots. The vulnerable code path resides in UbuntuCorpusTrainer.extract(), which downloads and unpacks Ubuntu dialog training corpus archives into the predictable, home-rooted path ~/ubuntu_data/ubuntu_dialogs. CWE-367 (Time-of-Check Time-of-Use Race Condition) applies: the code first checks whether the destination directory exists, then creates it, and subsequently calls tar.extractall(path=self.data_path). Python's tarfile.extractall() follows filesystem symlinks during extraction without additional validation, so if the target path has been replaced with a symlink between the check phase and the extract phase - or simply never existed so a symlink was pre-planted - the archive contents are deposited into the symlink's destination rather than the intended directory. The predictability of the path (rooted in the victim user's home directory, a fixed subdirectory name) makes pre-planting straightforward and does not require precise timing when the attacker acts before the first training invocation.
RemediationAI
Upgrade to ChatterBot version 1.2.14 or later, which resolves the TOCTOU symlink vulnerability in UbuntuCorpusTrainer.extract() via fix commit 82817b5c28bfd43e682b991bcc76e6f780726dbf (PR #2445: https://github.com/gunthercox/ChatterBot/pull/2445). The patched release is available at https://github.com/gunthercox/ChatterBot/releases/tag/1.2.14. If an immediate upgrade is not feasible, the most effective compensating control is to avoid executing UbuntuCorpusTrainer on shared multi-user systems altogether, removing the local attacker prerequisite. Alternatively, pre-creating ~/ubuntu_data/ubuntu_dialogs with owner-only permissions (chmod 700) before any training run reduces but does not fully eliminate the TOCTOU window since a determined attacker with prior access could still have planted the symlink earlier. Running ChatterBot training inside a dedicated container or isolated single-user environment is the strongest short-term mitigation if the patch cannot be applied immediately.
More in Chatterbot
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today