CVE-2025-7647: llama-index-core Race Condition Vulnerability

CVE-2025-7647 Overview

CVE-2025-7647 is an insecure temporary directory vulnerability in the llama-index-core Python package through version 0.12.44. The get_cache_dir() function uses a predictable, hardcoded path /tmp/llama_index on Linux systems without permission checks or safe directory creation semantics. On multi-user Linux hosts, a local attacker can pre-create the directory, plant malicious files, poison cached embeddings, exfiltrate proprietary models, or stage symlink attacks against the legitimate user. The issue is tracked under CWE-378, with related weaknesses CWE-377 and CWE-367 covering insecure temporary file creation and time-of-check to time-of-use race conditions.

Critical Impact
A local attacker on a shared Linux system can hijack the llama-index cache directory to poison AI model artifacts, steal proprietary models, or achieve code execution paths through symlink redirection.

Affected Products

llama-index-core versions up to and including 0.12.44
Linux deployments of LlamaIndex on multi-user or shared-tenant systems
Downstream applications that rely on get_cache_dir() for model or embedding caching

Discovery Timeline

2025-09-27 - CVE-2025-7647 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7647

Vulnerability Analysis

The get_cache_dir() helper in llama-index-core returns /tmp/llama_index as the caching location on Linux without validating ownership, permissions, or symlink safety. Because /tmp is world-writable, any local user can create /tmp/llama_index before the target process runs. When the LlamaIndex process later writes cached models, embeddings, or intermediate artifacts, it does so inside a directory the attacker already controls.

This enables three concrete attack classes. Attackers can read cached model files and embeddings that represent proprietary intellectual property. They can overwrite cache entries to poison downstream inference or retrieval-augmented generation (RAG) pipelines. They can replace files or subdirectories with symlinks pointing elsewhere in the filesystem, redirecting writes to arbitrary paths accessible to the target user.

Root Cause

The root cause is the use of a static, world-predictable path with no per-user isolation and no safe creation primitives such as tempfile.mkdtemp() or O_CREAT | O_EXCL. The function does not verify that an existing directory is owned by the current user or has restrictive permissions before writing to it. This pattern maps directly to CWE-378: Creation of Temporary File With Insecure Permissions.

Attack Vector

Exploitation requires local access with low privileges on a system where another user runs LlamaIndex workloads. The attacker pre-creates /tmp/llama_index or specific subpaths with permissive modes, or plants symlinks targeting sensitive files. When the victim process invokes the cache directory, it operates on attacker-controlled inodes. No user interaction is required, and the race window opens whenever the LlamaIndex application starts.

text

# Reference: upstream security patch (v0.13.0)
# Source: https://github.com/run-llama/llama_index/commit/98816394d57c7f53f847ed7b60725e69d0e7aae4

# llama-index-cli/pyproject.toml
-version = "0.4.4"
+version = "0.5.0"

# The v0.13.0 release replaces the hardcoded /tmp/llama_index path
# with a per-user cache location and safe directory creation semantics.

Source: run-llama/llama_index commit 98816394

Detection Methods for CVE-2025-7647

Indicators of Compromise

Existence of /tmp/llama_index owned by a user other than the process user, or with world-writable permissions
Symbolic links inside /tmp/llama_index pointing outside the cache tree, especially into user home directories or configuration paths
Unexpected modification timestamps or file contents in cached embedding, index, or model files
LlamaIndex processes producing inference results that diverge from a known-good baseline after cache population

Detection Strategies

Inventory hosts running Python environments and enumerate installed versions of llama-index-core with pip show llama-index-core; flag anything at or below 0.12.44.
Audit /tmp/llama_index on all Linux hosts for ownership, mode, and symlink presence using find /tmp/llama_index -printf "%u %m %p -> %l\n".
Alert on filesystem events where a non-root, non-owner process creates /tmp/llama_index before a LlamaIndex workload starts.

Monitoring Recommendations

Enable Linux audit rules on /tmp/llama_index for open, openat, symlink, and rename syscalls to capture pre-staging behavior.
Correlate process telemetry from Python interpreters loading llama_index modules with concurrent writes to /tmp/llama_index by other UIDs.
Baseline cache directory contents and hash cached embedding files to detect poisoning between runs.

How to Mitigate CVE-2025-7647

Immediate Actions Required

Upgrade llama-index-core and the llama-index-cli component to the patched v0.13.0 release or later, which removes the hardcoded /tmp/llama_index path.
Delete any existing /tmp/llama_index directory on shared Linux hosts and recreate the cache under a per-user path such as $XDG_CACHE_HOME/llama_index with mode 0700.
Restrict multi-user access on hosts running AI workloads and enforce the sticky bit on /tmp (typically default) to limit cross-user file operations.

Patch Information

The upstream fix is delivered in the v0.13.0 release of llama_index, referenced in commit 98816394d57c7f53f847ed7b60725e69d0e7aae4. The vulnerability report and coordination details are available at the Huntr bounty page. Verify installed versions after upgrade with pip show llama-index-core llama-index-cli.

Workarounds

Set the LLAMA_INDEX_CACHE_DIR environment variable (or equivalent configuration) to a user-owned directory under the home path, for example $HOME/.cache/llama_index, with mode 0700.
Run LlamaIndex workloads inside dedicated containers or systemd services with PrivateTmp=yes so that /tmp is namespaced per unit and inaccessible to other users.
Apply mandatory access controls (AppArmor or SELinux) to restrict the LlamaIndex process to a user-scoped cache path.

bash

# Configuration example: force a private, per-user cache directory
export LLAMA_INDEX_CACHE_DIR="$HOME/.cache/llama_index"
install -d -m 0700 "$LLAMA_INDEX_CACHE_DIR"

# systemd hardening for services running LlamaIndex
# /etc/systemd/system/llama-app.service.d/hardening.conf
[Service]
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=read-only
NoNewPrivileges=yes