llamaindex vulnerabilities

CVEs whose affected-version data names the llamaindex package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-7707High· 7.8

1y ago

The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments

The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt…

▾ Twilightllamaindex · llamaindexEPSS 0.19%via NVD