Homepage

chatterbot@1.2.13

ChatterBot is a machine learning, conversational dialog engine

  • latest version

    1.2.14

  • latest non vulnerable version

    1.2.14

  • first published

    11 years ago

  • latest version published

    15 days ago

  • licenses detected

    • BSD-3-Clause
      [0.5.3,0.5.4); [0.5.5,0.8.7); [1.0.0a3,1.0.3); [1.2.1,)
  • View chatterbot package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the chatterbot package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Time-of-check Time-of-use (TOCTOU) Race Condition

    ChatterBot is a ChatterBot is a machine learning, conversational dialog engine

    Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the extract function. An attacker can cause arbitrary files to be written to a directory of their choice by pre-planting a symlink at a predictable output path, which is then followed during archive extraction. This allows the attacker to control the destination of extracted files and potentially overwrite sensitive files or place malicious content.

    How to fix Time-of-check Time-of-use (TOCTOU) Race Condition?

    Upgrade ChatterBot to version 1.2.14 or higher.

    [,1.2.14)
    Go back to all versions of this package