CVE-2025-6211: LlamaIndex Vulnerable to Data Loss via Hash Collisions in DocugamiReader Class
Summary
CVE-2025-6211: LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class. Affects llama-index versions < 0.12.41. Fixed in 0.12.41. How to fix ↓
Also tracked for
- llama-index-readers-docugami · PyPI
The same CVE-2025-6211 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LlamaIndex is an open-source library designed for efficient document indexing and retrieval. It allows users to manage and query large sets of documents, making it a valuable tool for applications that require document processing and AI integration. The library includes various readers, including the DocugamiReader, which is intended to handle documents from the Docugami platform. However, a vulnerability has been identified in this reader that can lead to significant data loss.
Vulnerability Detail
The vulnerability arises from the use of MD5 hashing in the DocugamiReader class to generate unique IDs for document chunks. This method is prone to hash collisions, where different document chunks with identical text can produce the same hash value. As a result, one chunk may overwrite another, leading to the loss of important document content, disruption of parent-child chunk hierarchies, and potentially inaccurate outputs from AI models that rely on this data. The issue is particularly concerning as it can affect semantically or legally significant information.
How To Fix
Latest published version: 0.14.25 as of 23 Oct 2026
pip install --upgrade "llama-index==0.14.25"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.41
This is the first release that contains the fix.
pip install --upgrade "llama-index==0.12.41"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the DocugamiReader class until the package has been updated. Alternatively, consider using a different reader that does not rely on MD5 hashing for ID generation.
Conclusion
The identified vulnerability in the LlamaIndex library poses significant risks related to data integrity and accuracy. Users are strongly encouraged to update to the patched versions to mitigate these risks and ensure the reliability of their document processing applications.
See every vulnerability recorded for llama-index →
FAQ
The vulnerability involves hash collisions due to the use of MD5 hashing in the DocugamiReader class, which can lead to data loss.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The consequences include loss of important document content, disruption of data hierarchies, and inaccurate AI responses.
Yes, the vulnerability is patched in LlamaIndex version 0.12.41 and llama-index-readers-docugami version 0.3.1.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for llama-index.
