CVE-2026-10801

LOW

modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash

Title source: cna
STIX 2.1

Description

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-368250 | modelscope ms-swift PIL Image Cache Key base.py Template._save_pil_image weak hash
https://vuldb.com/vuln/368250
Signature, Permissions Required signature permissions-required
VDB-368250 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/368250/cti
Third Party Advisory third-party-advisory
CVE-2026-10801 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10801
Third Party Advisory third-party-advisory
Submit #831455 | modelscope ms-swift 4.2.0 Hash Collision
https://vuldb.com/submit/831455
Third Party Advisory third-party-advisory
Submit #831456 | modelscope ms-swift 4.2.0 Hash Collision (Duplicate)
https://vuldb.com/submit/831456

Scores

CVSS v3 3.6
EPSS 0.0009
EPSS Percentile 0.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-327 CWE-328
Status published
Products (3)
modelscope/ms-swift 4.0
modelscope/ms-swift 4.1
modelscope/ms-swift 4.2.0
Published Jun 04, 2026
Tracked Since Jun 04, 2026