CVE-2025-6211
Medium
Description
A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk overwriting another. This can cause loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1.
SeverityMedium
CVSS6.5
Exploit probability—
ProductLlamaindex
PublishedJul 10, 2025
First seenJul 10, 2025
Weakness typeCWE-440CWE-440
How to fix
Update
- llamaindex llamaindex0.3.1 or later
- llama-index0.12.41 or later
- llama-index-readers-docugami0.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| llamaindex llamaindex | v < 0.3.1 | 0.3.1 |
| llama-indexPyPI | v < 0.12.41 | 0.12.41 |
| llama-index-readers-docugamiPyPI | v < 0.3.1 | 0.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.