modelscope ms-swift up to 4.2.0 PIL Image Cache Key swift/template/base.py Template._save_pil_image weak hash

Summaryinfo

A vulnerability categorized as critical has been discovered in modelscope ms-swift up to 4.2.0. This vulnerability affects the function Template._save_pil_image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation results in weak hash. This vulnerability is known as CVE-2026-10801. Attacking locally is a requirement. Furthermore, an exploit is available. The pull request to fix this issue awaits acceptance.

Detailsinfo

A vulnerability was found in modelscope ms-swift up to 4.2.0. It has been classified as problematic. Affected is the function Template._save_pil_image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation with an unknown input leads to a weak hash vulnerability. CWE is classifying the issue as CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). This is going to have an impact on integrity, and availability.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-10801. The exploitability is told to be difficult. Local access is required to approach this attack. Technical details and a public exploit are known. This vulnerability is assigned to T1600.001 by the MITRE ATT&CK project.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The pull request to fix this issue awaits acceptance.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• modelscope

Name

• ms-swift

Version

• 4.0
• 4.1
• 4.2.0

Website

• Product: https://github.com/modelscope/ms-swift/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #831455: modelscope ms-swift 4.2.0 Hash Collision (by Dem0)

Duplicate

• Submit #XXXXXX: Xxxxxxxxxx Xx-xxxxx X.x.x Xxxx Xxxxxxxxx (by Dem0)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion