The vulnerability lies in the Template._save_pil_image function of ms-swift's PIL Image Cache Key Handler. In this component a weak hash algorithm is used to generate cache keys for images. Such cryptographic weak hash usage can lead to hash collisions when distinct images produce the same key. If an attacker can supply two images that map to the same key, the cache might serve a wrong image, compromising data integrity or allowing denial of service by evicting cache entries. The weakness is classified as CWE-327 and CWE-328, indicating insufficient algorithm strength.

Affected systems are all deployments of the modelscope ms-swift package with a version equal or less than 4.2.0. The CVE explicitly mentions up to version 4.2.0 inclusive. This includes any environments that have not yet applied the pending fix in the 4.2.1 release.

Risk: The CVSS base score is 2.0, reflecting limited impact. EPSS is unavailable but the exploitability is described as difficult with a high attack complexity. The vulnerability is only exploitable locally, so it requires the attacker to have local code execution or file write access in the environment where ms-swift runs. The vulnerability is not listed in CISA’s KEV catalog. Therefore the overall threat is low to moderate, but local administrators should still assess whether local attack vectors are possible in their setup.