ChatterBot CVE-2026-58198

Exploitation requires a local attacker with a valid user account on the same multi-user system as the victim. The victim must actively invoke ChatterBot's UbuntuCorpusTrainer.extract() method - this is not triggered automatically and is specific to users training models with the Ubuntu corpus dataset. The attacker must be able to manipulate the filesystem at the victim's ~/ubuntu_data/ path, which typically requires either write access to the victim's home directory (unlikely in properly configured systems) or the ability to pre-empt directory creation before the victim's first run (more feasible if the attacker acts before any prior training). Exploitation is meaningfully limited by: (1) requirement for local shell access on the target system; (2) the victim must be running the specific UbuntuCorpusTrainer class, not any other ChatterBot trainer; (3) on systems with proper home directory permissions, the attacker cannot reach ~/victim_home directly and must instead exploit a shared or world-writable intermediate path. Containerized or single-user deployments are not realistically exposed.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects local exploitation requiring only a standard user account, with low attack complexity given the predictable and stable target path. The official vector assigns C:H and I:N, but the mechanism also permits writing extracted corpus files to unauthorized filesystem locations, suggesting an integrity impact (I:L at minimum) may be understated. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The absence of a KEV listing and the lack of any identified public proof-of-concept indicate no confirmed active exploitation. Real-world risk is bounded by the requirement for local access on a shared system where another user actively invokes UbuntuCorpusTrainer; single-user developer environments and containerized deployments face negligible additional exposure. The corpus data being extracted (Ubuntu dialog training text) is not sensitive in itself, but the write-anywhere primitive created by the symlink redirect could be leveraged to deposit files into directories the attacker does not own, representing a meaningful local privilege escalation vector on multi-user systems beyond what the C:H-only framing implies.

A local attacker on a shared Linux server - such as a shared development host or a university compute cluster - learns that a victim user periodically retrains a ChatterBot model using UbuntuCorpusTrainer. Before the victim's first training run, the attacker creates a symlink at ~/victim_home/ubuntu_data/ubuntu_dialogs (if they have write access to that path) or simply waits for the victim to attempt creation and wins the race, redirecting it to /tmp/attacker_drop or another world-writable location the attacker monitors. When the victim runs training, tar.extractall() follows the symlink and deposits the extracted corpus into the attacker's chosen directory, which the attacker then reads. No public proof-of-concept has been identified at time of analysis.