{"data":{"id":"57a53f63-8ad3-43c9-ba15-5f99f20dea91","title":"CVE-2026-58198: ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14…","summary":"ChatterBot versions prior to 1.2.14 have a flaw in UbuntuCorpusTrainer.extract(), which writes to a predictable home-rooted directory (~/ubuntu_data/ubuntu_dialogs) using a check-then-create pattern before calling tar.extractall(path=self.data_path). A local attacker who pre-plants a symlink at that path can redirect extracted archive contents to an attacker-chosen directory.","solution":"Fixed in version 1.2.14.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-58198","publishedAt":"2026-07-09T19:17:06.933Z","cveId":"CVE-2026-58198","cweIds":["CWE-59","CWE-367"],"cvssScore":"5.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ChatterBot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ChatterBot UbuntuCorpusTrainer symlink attack during archive extraction","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"local","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00123,"epssCheckedAt":"2026-10-15T00:11:28.773Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:46:52.955Z","patchAvailable":null,"disclosureDate":"2026-07-09T19:17:06.933Z","capecIds":["CAPEC-27"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}