MD5 Hash Collision in run-llama/llama_index

Vulnerability

Analysis

The vulnerability in the DocugamiReader class of the run-llama/llama_index repository (up to version 0.12.28) stems from the use of MD5 hashing to generate unique identifiers for document chunks [1]. The function _build_framework_chunk computed the chunk ID as hashlib.md5(dg_chunk.text.encode()).hexdigest(), which only considered the text content of the chunk [3]. When multiple structurally distinct chunks (e.g., from different XML/HTML elements or table cells) contained identical text, they produced the same MD5 hash, leading to hash collisions [3].

Exploitation and

Impact

An attacker could craft a document with multiple regions sharing the same text but different structures or semantic contexts. During document parsing, these chunks would overwrite each other in storage, causing the loss of one or more chunks [1]. This breaks parent-child chunk hierarchies that rely on unique IDs and can result in an incomplete or corrupted representation of the original document [1]. Downstream AI systems relying on the indexed chunks may then produce inaccurate or hallucinated responses because they miss critical contextual or legal distinctions between the overwritten chunks [1].

Mitigation

Status

The issue is resolved in version 0.3.1 of the llama-index-readers-docugami package [3]. The fix modifies the hash input to include the chunk's XPath alongside its text (dg_chunk.xpath + "\n" + dg_chunk.text), ensuring that structurally different chunks with identical text generate distinct IDs [3]. Users should update to the patched version to prevent data loss and preserve document integrity [3].