Whatstk
Monthly
Silent message loss in whatstk 0.3.0 through 0.8.x lets a party who supplies one of the chat exports cause messages to vanish from the output of merge_chats() (reached through BaseChat.merge()) without any warning or count of what was removed. The merge keeps whole the chat whose first message is oldest and appends from the other export only messages strictly newer than that chat's last message, so every message of the second export that falls inside the already-covered date range is discarded; a message held by only one export is dropped whenever its date sits inside the range of the other. Exploitation requires the victim to run a merge over attacker-influenced input (local, active user interaction, no privileges needed), there is no code execution or confidentiality impact, the assessed severity is low (CVSS 1.8), no public exploit has been identified at time of analysis, and the vendor has released a fix in 0.9.0.
Silent message loss in whatstk 0.3.0 through 0.8.x lets a party who supplies one of the chat exports cause messages to vanish from the output of merge_chats() (reached through BaseChat.merge()) without any warning or count of what was removed. The merge keeps whole the chat whose first message is oldest and appends from the other export only messages strictly newer than that chat's last message, so every message of the second export that falls inside the already-covered date range is discarded; a message held by only one export is dropped whenever its date sits inside the range of the other. Exploitation requires the victim to run a merge over attacker-influenced input (local, active user interaction, no privileges needed), there is no code execution or confidentiality impact, the assessed severity is low (CVSS 1.8), no public exploit has been identified at time of analysis, and the vendor has released a fix in 0.9.0.