whatstk: Unbounded ZIP decompression denial-of-service (CVE-2026-121691)

The whatstk library versions prior to 0.9.0 are vulnerable to CVE-2026-121691, an improper handling of highly compressed data (CWE-409). The _str_from_file() function within the parser uses zip_ref.extractall() without validating archive member sizes or compression ratios. An attacker providing a maliciously crafted ZIP file can trigger significant memory and disk exhaustion as the library extracts, reads, and processes the contents, eventually leading to a process crash.

Impact

Successful exploitation results in a local denial-of-service (DoS) condition. An attacker-supplied archive can cause significant memory and disk usage during the processing of data via WhatsAppChat.from_source() or df_from_whatsapp(), potentially crashing the application or the hosting service.

Recommendation

• Upgrade the whatstk library to version 0.9.0 or later immediately to resolve the vulnerable ZIP parsing logic.
• Audit services that utilize whatstk to process user-supplied ZIP files to identify potential exposure points.