PT-2025-41794 · Unknown+1 · Llama Index+1

Published 2025-10-13 · Updated 2025-10-21 · CVE-2025-7707

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions llama index version 0.12.33

Description The software sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, potentially leading to denial of service, data tampering, or privilege escalation. The issue stems from using a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

DoS

LPE

Weakness Enumeration

CWE-377

Related Identifiers

CVE-2025-7707

GHSA-RG9H-VX28-XXP5

Affected Products

Nltk

Llama Index

References · 12

• 🔥 https://huntr.com/bounties/3fe2c8ab-6727-4aef-a0ef-4d2818e48803 · Exploit
• https://github.com/run-llama/llama_index/commit/98816394d57c7f53f847ed7b60725e69d0e7aae4 · Patch
• https://osv.dev/vulnerability/GHSA-rg9h-vx28-xxp5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-7707 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7707 · Security Note
• https://github.com/run-llama/llama_index · Note
• https://reddit.com/r/VulnMatter/comments/1o7bmsg/resumen_diario_de_vulnerabilidades_15102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o6h2pg/resumen_diario_de_vulnerabilidades_14102025 · Reddit Post
• https://t.me/cveNotify/138457 · Telegram Post
• https://t.me/CVEtracker/34783 · Telegram Post
• https://t.me/cveNotify/139622 · Telegram Post
• https://twitter.com/CVEnew/status/1977777811038359699 · Twitter Post