EUVD-2026-34242
GHSA-prfw-69r3-wqxf
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_pil_image of the file swift/template/base.py of the component PIL Image Cache Key Handler. The manipulation leads to use of weak hash. An attack has to be approached locally. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Cache key collision in modelscope ms-swift up to 4.2.0 allows a local, low-privileged attacker to cause PIL image integrity failures via the Template._save_pil_image function in swift/template/base.py. The root cause is that the image cache key was computed by hashing only raw pixel bytes (image.tobytes()), without incorporating image metadata such as dimensions or color mode - meaning two structurally different images (e.g., 120×80 vs 80×120) sharing identical byte payloads produce the same SHA-256 cache key and thus collide to the same cached file path. No public exploit identified at time of analysis beyond the publicly disclosed proof-of-concept; no active exploitation confirmed (not listed in CISA KEV).
Technical ContextAI
ms-swift is a scalable lightweight fine-tuning framework from ModelScope (Alibaba DAMO). The affected code path is Template._save_pil_image in swift/template/base.py, which caches PIL Image objects on disk using a SHA-256 hash as the filename. CWE-328 (Use of Weak Hash) applies here not because SHA-256 is cryptographically weak, but because the hash input is structurally incomplete: the pre-patch code hashed only image.tobytes() - raw pixel data - without including the image mode (e.g., RGB, RGBA), width, or height. Python's PIL/Pillow tobytes() returns a flat byte buffer; two images with different dimensions but the same total pixel count and same raw buffer content (or identical buffers reinterpreted across different shapes) are indistinguishable to the hash function. The fix, visible in PR #9359, prepends a metadata string formatted as 'mode:width:height:' before hashing, ensuring geometric and color-space properties are reflected in the cache key. Affected CPE: cpe:2.3:a:modelscope:ms-swift:*:*:*:*:*:*:*:*.
RemediationAI
Upstream fix available via GitHub pull request #9359 (https://github.com/modelscope/ms-swift/pull/9359); a released patched version is not independently confirmed as the PR awaits acceptance. Users should monitor the ms-swift release feed and upgrade to the first version released after PR #9359 is merged. As a compensating control, operators can disable or bypass the PIL image caching path in swift/template/base.py by patching the Template._save_pil_image method locally to prepend image metadata (mode, width, height) to the hash input before the official fix is available - the exact corrected logic is visible in the PR diff: img_meta = f'{image.mode}:{image.width}:{image.height}:'.encode(); img_hash = hashlib.sha256(img_meta + image.tobytes()).hexdigest(). This local patch carries the trade-off of diverging from upstream and requiring re-application on each update. Restricting write access to the PIL image cache directory to trusted processes only will reduce the blast radius but will not eliminate the collision condition.
Same weakness CWE-328 – Use of Weak Hash
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today