← Back

CVE-2025-3044

nvd nist
Published: Jul 7, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: security@huntr.dev (Secondary)

Description

A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in version 0.12.28.

Affected (1)

Llamaindex
1 product
Llamaindex
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Llamaindex
Before 0.12.28

Related CWEs

CWE-440
Expected Behavior Violation
A feature, API, or function does not perform according to its specification.

References (3)

Source: security@huntr.dev
Patch
Source: security@huntr.dev
ExploitThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
ExploitThird Party Advisory

Timeline

No history available yet.