High severity7.8NVD Advisory· Published Oct 13, 2025· Updated Jun 17, 2026
CVE-2025-7707
CVE-2025-7707
Description
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
llama-indexPyPI | < 0.13.0 | 0.13.0 |
Affected products
3- Range: unspecified
Patches
Vulnerability mechanics
References
4- github.com/run-llama/llama_index/commit/98816394d57c7f53f847ed7b60725e69d0e7aae4nvdPatchWEB
- huntr.com/bounties/3fe2c8ab-6727-4aef-a0ef-4d2818e48803nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-rg9h-vx28-xxp5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-7707ghsaADVISORY
News mentions
0No linked articles in our index yet.