A failure to use a cryptographically strong hash algorithm in the Vision Feature Cache’s _image_cache_key function creates a vulnerability classified as CWE‑327 and CWE‑328. The weakness permits the creation of hash collisions, allowing an attacker to substitute or overwrite cached data or confuse cache look‑ups, potentially compromising the integrity of the application’s state or disrupting service.

The flaw affects exo‑explore exo versions up to 1.0.71, specifically the Vision Feature Cache component located at src/exo/worker/engines/mlx/vision.py. No other vendors or product versions are currently listed as affected.

The CVSS score of 6.3 indicates a moderate risk, while the EPSS score of < 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack is described as having high complexity and difficult exploitation, yet public proof‑of‑concept code is available, meaning it could be used by attackers once the complexity barrier is overcome. Success requires remote access to the Vision Feature Cache endpoint and the ability to send specially crafted requests.