Insecure Temporary File Creation in Llama Index Core Package by Run Llama

CVE-2025-7647

What is CVE-2025-7647?

The llama-index-core package suffers from a vulnerability in the get_cache_dir() function, which relies on a hardcoded directory path (/tmp/llama_index) on Linux systems without adequate security measures. This flaw permits attackers on multi-user systems to access sensitive proprietary models, compromise cached embeddings, or initiate symlink attacks. All Linux deployments that support multi-user environments are susceptible, classifying this issue under multiple CWEs that emphasize insecure temporary file management and possible race conditions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References