GitHub Advisoryadvisory · PyPI

GHSA-p7j4-jwjf-5x9w LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions

MEDIUM Published 2025-07-07 Modified 2025-07-08 Official page ↗
Aliases
CVE-2025-3044
Ecosystem
PyPI
Packages
llama-index-readers-papers
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-440
Reviewed
2025-07-08

Affected packages

• PyPI llama-index-readers-papers: < 0.3.1 → fixed in 0.3.1

Description

A vulnerability in the ArxivReader class of the run-llama/llama_index repository allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in llama-index-readers-papers version 0.3.1 (in llama-index 0.12.28).

Related

Alias · CVE (1)

  • CVE-2025-3044 A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash… vulnerability

Weakness · CWE (1)

  • CWE-440 Expected Behavior Violation weakness

References