Executive brief
exo is an open-source platform for running AI models locally. A flaw in how the system caches image data allows for 'shape-collision' attacks, where two different images with different dimensions but identical raw pixel data are treated as the same. This can lead to incorrect AI inference results or a form of cache poisoning where one user's image data might influence the results of another user's request.
Technical details
The vulnerability exists in the `_image_cache_key` function within `src/exo/worker/engines/mlx/vision.py`. The implementation computes a SHA-256 hash using `PIL.Image.tobytes()`, which returns raw pixel data but excludes image dimensions (width and height). Consequently, two images with different aspect ratios (e.g., 6x4 vs 4x6) that share the same raw byte sequence will produce identical hashes. This results in a deterministic cache collision. An attacker can exploit this remotely to cause the vision encoder to return incorrect features from the cache or potentially poison the shared `_feature_cache` in multi-user environments. A fix involving the inclusion of image dimensions in the hash generation has been proposed in pull request #2152.
Affected products
- exo-explore exo up to 1.0.71
Timeline
- 2026-06-05: disclosed: Issue and pull request opened on GitHub
- 2026-07-05: advisory: CVE-2026-14738 published