PT-2026-46180 · Modelscope · Ms-Swift

Dem0 · CVE-2026-10801 · Published 2026-06-04 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions modelscope ms-swift versions prior to 4.2.1

Description The PIL Image Cache Key Handler component contains an issue where the Template. save pil image() function in the swift/template/base.py file uses a weak hash. Exploitation requires local access and is characterized by high complexity and difficult exploitability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-328

CWE-327

Related Identifiers

CVE-2026-10801

GHSA-PRFW-69R3-WQXF

PYSEC-2026-3488

Affected Products

Ms-Swift

References · 17

• 🔥 https://github.com/modelscope/ms-swift/issues/9360 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10801.json · Exploit
• https://github.com/modelscope/ms-swift/pull/9359 · Patch
• https://osv.dev/vulnerability/CVE-2026-10801 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-prfw-69r3-wqxf · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-3488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10801 · Security Note
• https://github.com/modelscope/ms-swift · Note
• https://github.com/modelscope/ms-swift/commit/27426a6431759a82e2a1c98344b425f90be17e07 · Note
• https://vuldb.com/vuln/368250 · Note
• https://vuldb.com/vuln/368250/cti · Note
• https://vuldb.com/submit/831455 · Note
• https://vuldb.com/cve/CVE-2026-10801 · Note
• https://github.com/advisories/GHSA-prfw-69r3-wqxf · Note
• https://t.me/cveNotify/165957 · Telegram Post