CVE-2025-7707

Name of the Vulnerable Software and Affected Versions llama index version 0.12.33

Description The software sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, potentially leading to denial of service, data tampering, or privilege escalation. The issue stems from using a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.

Recommendations Update to a newer version that contains a fix for this vulnerability.