CyberRota Analysis
AI-GeneratedChatterBot versions prior to 1.2.14 on Ubuntu are vulnerable due to a predictable output directory in the UbuntuCorpusTrainer.extract() method, allowing local attackers to exploit a symlink to redirect extracted archive contents to arbitrary locations. This can lead to unauthorized file manipulation or data exposure on the affected system. Users and administrators of ChatterBot on Ubuntu should prioritize upgrading to version 1.2.14 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by tar.extractall(path=self.data_path), allowing a local attacker who pre-plants a symlink at the predictable path to cause archive contents to be written through the symlink to an attacker-chosen directory. This issue is fixed in version 1.2.14.