CVE-2026-14738
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A security flaw in exo-explore exo up to version 1.0.71 uses a weak hash function in the _image_cache_key function of the Vision Feature Cache component. The vulnerability allows remote attacks but is difficult to exploit due to high complexity. A public exploit has been released and may be used in attacks.
Risk Assessment
The organization faces potential integrity breaches in the image cache, which could lead to data tampering or unauthorized access to sensitive information. High attack complexity reduces risk, but the public exploit increases the urgency for patching.
Recommendation
Immediately apply the available patch or update exo-explore exo to a version above 1.0.71 once the fix is accepted. Until then, restrict access to the Vision Feature Cache component.
Original NVD description (English source)
A security flaw has been discovered in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.