CVE-2025-6211: 
Python vulnerability analysis and mitigation

CVE-2025-6211 is a data integrity vulnerability in the DocugamiReader class of the run-llama/llama_index library, caused by the use of MD5 hashing to generate IDs for document chunks. When structurally distinct chunks contain identical text, hash collisions occur, causing one chunk to silently overwrite another. This affects llama-index (pip) versions below 0.12.41 and llama-index-readers-docugami versions below 0.3.1. The vulnerability was published on July 10, 2025, and carries a CVSS v3.0 base score of 6.5 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-440 (Expected Behavior Violation): the _build_framework_chunk function in base.py computed chunk IDs using hashlib.md5(dg_chunk.text.encode()).hexdigest(), hashing only the chunk's text content without incorporating any structural identifier such as its XPath location. When two document chunks at different structural positions share identical text, they produce the same MD5 hash, and the second chunk overwrites the first in the document store. The fix, introduced in commit 29b2e07, concatenates the chunk's XPath with its text before hashing (dg_chunk.xpath + "\n" + dg_chunk.text), ensuring structural uniqueness is reflected in the ID (GitHub Commit, Github Advisory). The attack vector is network-accessible with no authentication or user interaction required, as the flaw is triggered during normal document ingestion (Feedly).

Successful exploitation of this vulnerability results in silent loss of document chunks during ingestion, particularly affecting documents with repeated text across structurally distinct sections (e.g., legal contracts, compliance documents). This breaks parent-child chunk hierarchies used for context-aware retrieval, leading to incomplete or corrupted document representations in the vector store. Downstream AI outputs — including summaries, question-answering, and retrieval-augmented generation responses — may become inaccurate or hallucinated due to missing content. There is no confidentiality impact, but integrity and availability are both rated Low (Github Advisory, Feedly).

A proof-of-concept exploit is publicly available via the Huntr bug bounty platform, but there is no evidence of active in-the-wild exploitation at this time (Huntr PoC). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036% (0.000360), indicating a low near-term exploitation probability (Feedly). No threat actor attribution has been reported.

1. Identify a target: Locate an application using llama-index or llama-index-readers-docugami below the patched versions that ingests Docugami XML documents via the DocugamiReader class.
2. Craft a malicious document: Prepare a Docugami-formatted XML document containing two or more structurally distinct chunks (at different XPath locations) that share identical text content — for example, a repeated clause appearing in different sections of a legal contract.
3. Trigger document ingestion: Submit or upload the crafted document to the target application so that DocugamiReader processes it and calls _build_framework_chunk for each chunk.
4. Hash collision occurs: Because the chunk ID is computed solely from the text (hashlib.md5(dg_chunk.text.encode()).hexdigest()), both chunks produce the same ID. The second chunk silently overwrites the first in the document store.
5. Observe impact: The overwritten chunk is permanently lost from the index. Subsequent AI queries against the document will return incomplete, inaccurate, or hallucinated responses due to the missing content (Huntr PoC, GitHub Commit).

• Logs: Unexpected reduction in the number of indexed document chunks after ingestion of documents known to contain repeated text sections; warnings or silent overwrites in document store write logs.
• Application Behavior: AI-generated responses that omit known document content or produce hallucinated answers for queries targeting sections with repeated text; broken parent-child chunk relationships in retrieval results.
• File System / Data Store: Document chunk counts in the vector store that are lower than expected for a given document; missing chunk entries for XPath locations that should contain content identical to other sections.

Upgrade llama-index-readers-docugami to version 0.3.1 or later, and llama-index (pip) to version 0.12.41 or later, which incorporate the fix that includes the chunk's XPath in the hash input to prevent collisions (Github Advisory, GitHub Commit). After upgrading, re-ingest any documents previously processed with the vulnerable version to ensure chunk integrity. As an interim measure if upgrading is not immediately possible, implement additional validation of chunk counts and parent-child hierarchy consistency after ingestion, and treat AI outputs from affected pipelines with caution (Feedly).