Local Data Tampering Vulnerability in Llama Index Library by Llama Inc.

CVE-2025-7707

What is CVE-2025-7707?

The Llama Index Library version 0.12.33 contains a vulnerability that unintentionally sets the NLTK data directory to a world-writable subdirectory of the codebase. This misconfiguration permits local users in multi-user environments to overwrite, delete, or corrupt NLTK data files, posing risks such as denial of service, data tampering, or privilege escalation. The use of a shared cache directory rather than a user-specific one increases the likelihood of malicious data manipulation and threatens the integrity and functionality of the application.

References