CVE-2025-6211

A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk overwriting another. This can cause loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/run-llama/llama_index/commit/29b2e07e64ed7d302b1cc058185560b28eaa1352
https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389
https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389

Configurations

No configuration.

History

10 Jul 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-10 13:15

Updated : 2025-07-10 16:15

NVD link : CVE-2025-6211

Mitre link : CVE-2025-6211

CVE.ORG link : CVE-2025-6211

JSON object : View

Products Affected

No product.

CWE

CWE-440

Expected Behavior Violation

{"id": "CVE-2025-6211", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2025-07-10T13:15:23.137", "references": [{"url": "https://github.com/run-llama/llama_index/commit/29b2e07e64ed7d302b1cc058185560b28eaa1352", "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389", "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-440"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk overwriting another. This can cause loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1."}, {"lang": "es", "value": "Una vulnerabilidad en la clase DocugamiReader del repositorio run-llama/llama_index, hasta la versi\u00f3n 0.12.28, implica el uso de hash MD5 para generar identificadores para fragmentos de documentos. Este enfoque provoca colisiones de hash cuando fragmentos estructuralmente distintos contienen texto id\u00e9ntico, lo que provoca que un fragmento sobrescriba a otro. Esto puede provocar la p\u00e9rdida de contenido sem\u00e1ntico o legalmente importante del documento, la ruptura de las jerarqu\u00edas de fragmentos padre-hijo y respuestas inexactas o alucinadas en las salidas de IA. El problema se ha resuelto en la versi\u00f3n 0.3.1."}], "lastModified": "2025-07-10T16:15:24.993", "sourceIdentifier": "security@huntr.dev"}