CVE-2025-7707: Llamaindex Privilege Escalation Flaw

CVE-2025-7707 Overview

CVE-2025-7707 affects the llama_index library version 0.12.33. The library sets the Natural Language Toolkit (NLTK) data directory to a subdirectory of the codebase by default. In multi-user environments, this directory is world-writable. Local users can overwrite, delete, or corrupt NLTK data files consumed by other users of the library. The flaw is tracked as an insecure temporary/shared file usage issue [CWE-377].

Critical Impact
Local users on shared systems can tamper with NLTK data files used by llama_index, leading to denial of service, data tampering, or privilege escalation when higher-privileged processes load the poisoned data.

Affected Products

LlamaIndex llama_index version 0.12.33
Python environments where llama-index-cli prior to 0.5.0 is installed system-wide
Multi-user Linux and Unix hosts running LlamaIndex-based pipelines

Discovery Timeline

2025-10-13 - CVE-2025-7707 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7707

Vulnerability Analysis

The llama_index library configures NLTK to store downloaded corpora and tokenizer data in a directory located inside the installed package path. When Python packages are installed into a shared location such as /usr/lib/python3/site-packages, the resulting NLTK cache is reachable and writable by any local account. Any user on the host can modify the pickled models and text corpora that llama_index loads at runtime.

Because NLTK data files include serialized Python objects, tampering is not limited to denial of service. A low-privileged attacker can replace a legitimate resource with a malicious payload that executes in the context of a higher-privileged user the next time llama_index invokes NLTK functionality. The result is a local privilege escalation path that pivots through a trusted machine-learning dependency.

Root Cause

The root cause is the use of a shared, world-writable cache directory instead of a per-user path such as ~/.nltk_data or an XDG-compliant cache directory. This design choice violates least-privilege file storage guidance and matches the pattern described in [CWE-377: Insecure Temporary File].

Attack Vector

Exploitation requires local access with low privileges. The attacker writes to the NLTK data directory bundled with llama_index, replacing corpus or tokenizer files. When another user or service account executes a llama_index workflow that loads the tampered file, the attacker-controlled content is deserialized or parsed within that user's process.

text

# Security patch reference from llama-index-cli/pyproject.toml (v0.13.0 release, #19571)
[project]
name = "llama-index-cli"
-version = "0.4.4"
+version = "0.5.0"
description = "llama-index cli"
authors = [{name = "llamaindex"}]
requires-python = ">=3.9,<4.0"

Source: run-llama/llama_index commit 98816394

Detection Methods for CVE-2025-7707

Indicators of Compromise

Unexpected modifications to files under the nltk_data directory inside a llama_index installation path.
Presence of world-writable permissions (0777) on directories under the installed llama_index package.
Non-root user accounts writing to site-packages or virtual environment paths.

Detection Strategies

Audit filesystem permissions on all llama_index installations and flag any NLTK data directory that is group- or world-writable.
Monitor process telemetry for non-privileged users writing .pickle, .zip, or .txt files into Python site-packages paths.
Alert when service accounts running LlamaIndex workloads load NLTK resources whose file hashes deviate from a known-good baseline.

Monitoring Recommendations

Enable file integrity monitoring on the nltk_data directory and any Python package caches used by shared services.
Log Python interpreter invocations that import llama_index alongside the effective UID and the paths accessed for NLTK resources.
Track package version metadata for llama-index-cli and the core llama_index distribution to confirm patched builds are deployed.

How to Mitigate CVE-2025-7707

Immediate Actions Required

Upgrade llama_index beyond version 0.12.33 and llama-index-cli to version 0.5.0 or later.
Reset permissions on any existing nltk_data directory inside the llama_index package to remove world-writable access.
Reinstall NLTK data resources from trusted sources after confirming no tampering occurred.

Patch Information

The fix is delivered as part of the v0.13.0 release documented in run-llama/llama_index commit 98816394. Additional context is available in the Huntr bounty listing.

Workarounds

Set the NLTK_DATA environment variable to a per-user directory such as ~/.nltk_data before launching any llama_index workflow.
Restrict permissions on the packaged NLTK data directory to the owning service account only.
Install llama_index inside isolated virtual environments per user rather than a shared system-wide Python install.

bash

# Configuration example: force NLTK to use a per-user data path
export NLTK_DATA="$HOME/.nltk_data"
mkdir -p "$NLTK_DATA"
chmod 700 "$NLTK_DATA"

# Remove world-writable permissions from any existing shared cache
find /usr/lib/python3/site-packages/llama_index -type d -name nltk_data \
  -exec chmod -R o-w {} +