CVE-2025-7707
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from using a shared cache directory instead of a user-specific one.
Risk Assessment
A local attacker can modify or delete NLTK data files, causing denial of service, data tampering, or privilege escalation in multi-user environments.
Recommendation
Update the llama_index library to a version that does not use a shared cache directory for NLTK data, or configure the NLTK data directory to be user-specific with appropriate permissions. Restrict write permissions to the codebase directory.
Other vulnerabilities in llama_index
See all- CVE-2023-39662Critical
Versions of llama_index up to 0.7.13 contain a vulnerability that allows a remote attacker to execute arbitrary code via the `exec` parameter in the PandasQueryEngine function.
- CVE-2025-6210Medium
A vulnerability in the ObsidianReader class of run-llama/llama_index version 0.12.27 allows hardlink-based path traversal. Attackers can bypass path restrictions and access sensitive system files such as /etc/passwd by exploiting hardlinks; the flaw stems from inadequate hardlink handling in the load_data() method. The issue is resolved in version 0.5.2.
Original NVD description (English source)
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS