The vulnerability resides in the file indexer/chunker.go of the Qdrant Backend component in grepai. It causes the application to use a weak hash function, which can potentially allow attackers to craft hash collisions or preimage attacks. This weak hashing undermines data integrity and could be leveraged if hashes are used for authentication, checksums, or indexing, potentially enabling further exploitation. The semi-remote attack scenario is noted, but the exploit is described as highly complex and difficult to execute.

The issue affects yoanbernabeu grepai version 0.35.0 specifically when the Qdrant Backend is used for file indexing. No other product versions are listed.

The CVSS score of 2.3 indicates a low severity level. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. An attacker could theoretically perform a remote exploit, but the described complexity and difficulty make immediate exploitation unlikely. The problem has been disclosed publicly, but a fix is awaiting acceptance in the upstream repository, so current mitigations rely on awaiting a patched release or temporary measures.