{"cve":"CVE-2025-6211","nvd":{"published":"2025-07-10T13:15:23.137","modified":"2026-06-17T10:01:23.637","status":"Analyzed","description":"A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk overwriting another. This can cause loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":6.5},"cwes":["CWE-440"],"references":["https://github.com/run-llama/llama_index/commit/29b2e07e64ed7d302b1cc058185560b28eaa1352","https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389","https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389"],"products":["llamaindex:llamaindex"],"source":"nvd","synced_at":"2026-10-19T22:04:28.436527499+00:00"},"epss":{"cve":"CVE-2025-6211","score":0.00361,"percentile":0.29886,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-5hq9-5r78-2gjh","url":"https://osv.dev/vulnerability/GHSA-5hq9-5r78-2gjh","summary":"LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class ","modified":"2026-09-10T03:50:25.877040585Z","packages":[{"ecosystem":"PyPI","name":"llama-index","purl":"pkg:pypi/llama-index","ranges":["<0.12.41"],"fixed":["0.12.41"]},{"ecosystem":"PyPI","name":"llama-index-readers-docugami","purl":"pkg:pypi/llama-index-readers-docugami","ranges":["<0.3.1"],"fixed":["0.3.1"]}]},{"id":"PYSEC-2026-1566","url":"https://osv.dev/vulnerability/PYSEC-2026-1566","summary":"LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class ","modified":"2026-07-13T16:43:15.567324329Z","packages":[{"ecosystem":"PyPI","name":"llama-index-readers-docugami","purl":"pkg:pypi/llama-index-readers-docugami","ranges":["<0.3.1"],"fixed":["0.3.1"]}]},{"id":"PYSEC-2026-2606","url":"https://osv.dev/vulnerability/PYSEC-2026-2606","summary":"LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class ","modified":"2026-07-13T16:43:15.567324329Z","packages":[{"ecosystem":"PyPI","name":"llama-index","purl":"pkg:pypi/llama-index","ranges":["<0.12.41"],"fixed":["0.12.41"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}