CVE-2025-6211

Executive Summary

CVE-2025-6211 is a vulnerability in the DocugamiReader class of the run-llama/llama_index repository, affecting versions up to 0.12.28. The vulnerability arises from the use of the MD5 hashing algorithm to generate unique identifiers for document chunks. Due to MD5's known collision weaknesses, structurally distinct chunks containing identical text can produce the same hash, leading to one chunk overwriting another. This results in the loss of semantically or legally important document content, breakage of parent-child chunk hierarchies, and potentially inaccurate or hallucinated responses in AI outputs. The issue is resolved in version 0.3.1, which replaces MD5 with a collision-resistant hashing algorithm.

Supply Chain & Package Security

This vulnerability affects the llama_index Python package, which is distributed via PyPI. Users of this package are at risk if they use the DocugamiReader class to process documents. The supply chain risk is moderate, as the vulnerability is specific to a single component and does not affect the entire package ecosystem. However, any application that relies on DocugamiReader for document chunking and indexing is vulnerable.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: High (A:H)

The threat level is medium due to the potential for data loss and AI hallucination, but the attack complexity is low, and no privileges are required.

Deep Dive & Mechanics

The DocugamiReader class is designed to read and chunk documents for indexing in the LlamaIndex framework. It uses MD5 hashing to generate unique IDs for each chunk. The vulnerability lies in the fact that MD5 is cryptographically broken and susceptible to collision attacks. When two structurally distinct chunks contain identical text (e.g., repeated boilerplate or legal disclaimers), they produce the same MD5 hash. This causes the second chunk to overwrite the first in the index, leading to data loss.

The impact is twofold:

1. Data Loss: Important document content is lost, breaking the hierarchical structure of parent-child chunks.
2. AI Hallucination: The AI model may generate inaccurate or hallucinated responses because it lacks the full context of the document.

The fix in version 0.3.1 replaces MD5 with a collision-resistant hashing algorithm, such as SHA-256, ensuring that distinct chunks always have unique IDs.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 0.12.28):

import hashlib

class DocugamiReader:
    def _generate_chunk_id(self, chunk_text):
        return hashlib.md5(chunk_text.encode()).hexdigest()

Patched Code (version >= 0.3.1):

import hashlib

class DocugamiReader:
    def _generate_chunk_id(self, chunk_text):
        return hashlib.sha256(chunk_text.encode()).hexdigest()

The patched code uses SHA-256, which is collision-resistant, ensuring that each chunk receives a unique ID.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to craft documents with identical text in structurally distinct chunks. For example, a document with repeated legal disclaimers or boilerplate text could cause hash collisions, leading to data loss. The attacker could then feed these documents to a system using the vulnerable DocugamiReader, causing the AI to produce inaccurate or hallucinated responses.

Proof of Concept (PoC):

import hashlib

# Simulate vulnerable chunk ID generation
def vulnerable_chunk_id(chunk_text):
    return hashlib.md5(chunk_text.encode()).hexdigest()

# Two structurally distinct chunks with identical text
chunk1 = "This is a legal disclaimer."
chunk2 = "This is a legal disclaimer."

id1 = vulnerable_chunk_id(chunk1)
id2 = vulnerable_chunk_id(chunk2)

print(f"Chunk 1 ID: {id1}")
print(f"Chunk 2 ID: {id2}")
print(f"Collision: {id1 == id2}")

Blue Team

To detect exploitation attempts, monitor for documents with repeated identical text segments that could cause hash collisions. Additionally, check for anomalies in the chunk indexing process, such as missing chunks or unexpected overwrites.

Detection Steps:

1. Monitor logs for duplicate chunk IDs.
2. Use file integrity monitoring to detect changes in document chunk indexes.
3. Implement input validation to reject documents with excessive repeated text.

Indicators of Compromise (IOCs)

• File Hashes: MD5 hashes of documents that cause collisions (e.g., d41d8cd98f00b204e9800998ecf8427e for empty text).
• Log Entries: Duplicate chunk ID warnings in LlamaIndex logs.
• Network Traffic: Unusual patterns of document uploads to systems using DocugamiReader.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_DocugamiReader {
    meta:
        description = "Detects usage of MD5 in DocugamiReader chunk ID generation"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "sha256:abc123..."
    strings:
        $md5 = "hashlib.md5" ascii wide nocase
        $chunk_id = "_generate_chunk_id" ascii wide nocase
    condition:
        $md5 and $chunk_id
}

Sigma Rule

title: Detection of Vulnerable DocugamiReader MD5 Usage
id: abc12345-6789-4def-9012-3456789abcde
status: experimental
description: Detects the use of MD5 hashing in DocugamiReader chunk ID generation
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains: 'hashlib.md5'
    condition: selection
falsepositives:
    - Legitimate use of MD5 in other contexts
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Potential DocugamiReader Exploitation - MD5 Collision"; flow:to_server; content:"DocugamiReader"; nocase; content:"md5"; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade llama_index to version 0.3.1 or later.
2. Workaround: If upgrading is not possible, modify the DocugamiReader class to use a collision-resistant hashing algorithm (e.g., SHA-256) manually.
3. Long-term: Implement input validation to reject documents with excessive repeated text that could cause collisions.
4. Monitoring: Enable logging for chunk ID generation and monitor for duplicate IDs.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert