CVE-2025-7707
High
Description
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.
SeverityHigh
CVSS7.8
Exploit probability—
ProductLlamaindex
PublishedOct 13, 2025
First seenOct 13, 2025
Weakness typeCWE-377CWE-377
How to fix
Update
- llamaindex llamaindex0.13.0 or later
- llama-index0.13.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| llamaindex llamaindex | 0.12.33 ≤ v < 0.13.0 | 0.13.0 |
| llama-indexPyPI | v < 0.13.0 | 0.13.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.