PYSEC-2026-1569

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/llama-index-readers-papers/PYSEC-2026-1569.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-1569

Aliases

Published

2026-07-07T16:02:56Z

Modified

2026-07-13T07:26:33Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions

Details

A vulnerability in the ArxivReader class of the run-llama/llama_index repository allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in llama-index-readers-papers version 0.3.1 (in llama-index 0.12.28).

References

Affected packages

PyPI / llama-index-readers-papers

Package

Name: llama-index-readers-papers; View open source insights on deps.dev
Purl: pkg:pypi/llama-index-readers-papers

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.3.1

Affected versions

0.*

0.0.1

0.1.0

0.1.1

0.1.2

0.1.3

0.1.4

0.1.5

0.1.6

0.2.0

0.3.0

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/llama-index-readers-papers/PYSEC-2026-1569.yaml"