CVE-2025-7707High· 7.8▾ TwilightThe llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.2%
Last analysed / modified upstream
7.1 → 7.8
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.
llamaindex >= 0.12.33, < 0.13.0Upgrade past the affected range:
llamaindex 0.13.0Affected packages:
llama-index < 0.13.0Patched in:
llama-index 0.13.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113713Medium· 4.4virtualenv: Temporary app-data can leave dangling seed package links
CVE-2026-64672MediumTerragrunt catalog predictable temp symlink clobber
CVE-2026-53759Lowlinuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations
CVE-2026-93864High· 7.1Fireware OS Link Following in firewalld Allows Local Arbitrary File Overwrite as Root
CVE-2026-76497Medium· 6.6Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities
CVE-2025-14307High· 8.1An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6