CVE-2025-7647High· 7.3▾ TwilightThe llama-index-core package, up to version 0.12.44, contains a vulnerability in the `get_cache_dir()` function where a predictable, hardcoded directory path `/tmp/llama_index` is used on Linux systems without proper security controls. T…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
0.1% → 0.1%
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the get_cache_dir() function where a predictable, hardcoded directory path /tmp/llama_index is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal proprietary models, poison cached embeddings, or conduct symlink attacks. The issue affects all Linux deployments where multiple users share the same system. The vulnerability is classified under CWE-379, CWE-377, and CWE-367, indicating insecure temporary file creation and potential race conditions.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
llama-index-core < 0.13.0Patched in:
llama-index-core 0.13.0Source: https://osv.dev/vulnerability/GHSA-cr7q-2w66-hjcm
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-3098Critical· 9.8llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
CVE-2025-3108Medium· 5.0LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component
CVE-2025-5302High· 8.6LlamaIndex affected by a Denial of Service (DOS) in JSONReader
CVE-2025-6208Medium· 5.3llama-index-core vulnerable to Uncontrolled Resource Consumption
CVE-2025-5472Medium· 6.5LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing
CVE-2025-6209High· 7.5LlamaIndex vulnerable to Path Traversal attack through its encode_image function