The vulnerability is located in the PostgresStore.LookupByContentHash function within the Postgres Embedding Cache module. An attacker with local access can manipulate the content_hash argument, causing the application to use a weak hash algorithm. This weak hash creates a risk of collisions or other integrity weaknesses, but does not provide remote code execution or direct disclosure of secrets.

The flaw affects the grepai project by yoanbernabeu, up to and including version 0.35.0. Users running this version in any environment that allows local modification of the content_hash parameter are vulnerable.

The CVSS score of 2 indicates low severity. The exploit is local, requiring the attacker to run code on the same host with sufficient privileges, and is described as difficult. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The limited scope and privacy of the local attack surface make this a low‑risk vulnerability, yet it is publicly disclosed and could be employed by a local attacker to influence the hash algorithm used.