PT-2025-29091 · Unknown · Llama Index

Published 2025-07-10 · Updated 2025-07-10 · CVE-2025-6211

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: llama index versions up to 0.12.28 Description: A vulnerability exists in the DocugamiReader class of the llama index repository. The use of MD5 hashing to generate IDs for document chunks can lead to hash collisions when structurally distinct chunks contain identical text. This can result in the overwriting of document chunks, loss of content, breakage of chunk hierarchies, and inaccurate AI outputs. Recommendations: Update to version 0.3.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-440

Related Identifiers

CVE-2025-6211

GHSA-5HQ9-5R78-2GJH

Affected Products

Llama Index

References · 7

• 🔥 https://huntr.com/bounties/1a48a011-a3c5-4979-9ffc-9652280bc389 · Exploit
• https://github.com/run-llama/llama_index/commit/29b2e07e64ed7d302b1cc058185560b28eaa1352 · Patch
• https://osv.dev/vulnerability/GHSA-5hq9-5r78-2gjh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6211 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6211 · Vendor Advisory
• https://github.com/run-llama/llama_index · Note
• https://twitter.com/VulmonFeeds/status/1943402588759564583 · Twitter Post