CVE-2026-58198

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by tar.extractall(path=self.data_path), allowing a local attacker who pre-plants a symlink at the predictable path to cause archive contents to be written through the symlink to an attacker-chosen directory. This issue is fixed in version 1.2.14.

• CWE-59
• CWE-367

• https://github.com/gunthercox/ChatterBot/commit/82817b5c28bfd43e682b991bcc76e6f780726dbf
• https://github.com/gunthercox/ChatterBot/pull/2445
• https://github.com/gunthercox/ChatterBot/releases/tag/1.2.14
• https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-wvrh-2f4m-924v
• https://github.com/gunthercox/ChatterBot/security/advisories/GHSA-wvrh-2f4m-924v

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-58187The Apache Traffic Server multiplexer plugin overruns its ch…7.5
• CVE-2026-58188Several Apache Traffic Server experimental plugins have memo…8.4
• CVE-2026-58189Apache Traffic Server allows redirect-limit bypass when plug…8.2
• CVE-2026-58191Appium is a cross-platform automation framework for all kind…6.1
• CVE-2026-58192Appium is a cross-platform automation framework for all kind…8.6
• CVE-2026-58195Agentic-Flow is an AI agent orchestration platform. Prior to…8.8
• CVE-2026-5820The Zypento Blocks plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-58203pydantic-settings provides settings management using Pydanti…5.3
• CVE-2026-58207NATS Server is a high-performance server for NATS.io, the cl…6.5
• CVE-2026-58208NATS Server is a high-performance server for NATS.io, the cl…7.5
• CVE-2026-58209NATS Server is a high-performance server for NATS.io, the cl…4.3
• CVE-2026-5821The Image Optimizer plugin for WordPress is vulnerable to ar…8.1