The vulnerability arises from a missing comparison factor in the chat merging routine, a CWE-1023 issue, causing all messages whose timestamps fall inside the date range of an existing chat to be silently discarded. When two chat exports overlap, the merge keeps only the newer messages from the second export, and any message that is chronologically within the first chat’s period is removed without any warning or record of the loss. This flaw can corrupt forensic reviews or training datasets that rely on complete message histories, potentially erasing critical information from the merged output.

The issue exists in the whatstk Python library versions 0.3.0 through 0.8.x, as maintained by the vendor lucasrodes. The vulnerability is fixed in whatstk 0.9.0 and later, which implements proper comparison of individual message identities rather than solely date ranges.

With a CVSS score of 1.8 the severity is low, and no EPSS score is available, indicating limited evidence of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack scenario involves any user—whether malicious or accidental—who supplies chat export files to the merge function, such as a developer, forensic analyst, or automated pipeline. Because the vulnerability is triggered by local input data and does not rely on remote code execution or privileged operations, the operational risk is modest, but the loss of data could be significant for forensic or training use cases.