The flaw resides in Streamlit's internal caching layer, specifically the Palette handler used by hashing functions. By using a weak hash algorithm, an attacker with local system access can craft inputs that collide, potentially overriding cached data or bypassing expected behavior. This could degrade data integrity or allow subtle manipulation of the application state. The weakness corresponds to CWE-327 and CWE-328, indicating the use of weak cryptographic algorithms.

Streamlit library versions up to 1.53.0 are affected. Any deployment running Streamlit 1.53.0 or earlier, regardless of operating system, is potentially vulnerable. The issue is confined to the internal caching component and does not extend to external network services.

The CVSS score of 2.0 labels the vulnerability as low severity. Exploitation requires local access and is difficult, and the issue has not been identified in the CISA KEV catalog. Consequently, the threat is limited to environments where an attacker can run or modify Streamlit processes locally, while remote attacks are unlikely. Administrators should monitor the Streamlit repository for a fix before considering any change to local user policies.