Vulnerability PYSEC-2026-1556
High Risk
HIGH RISK
CVSS Score: 7.1
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
July 07, 2026 at 04:03 PM UTC
llama-index has Insecure Temporary File
0.4.4 - 0.12.52
0.4.4 - 0.12.52
Summary
llama-index has Insecure Temporary File
Details
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data tampering, or privilege escalation. The vulnerability arises from the use of a shared cache directory instead of a user-specific one, making it susceptible to local data tampering and denial of service.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
0.4.4 - 0.12.40 PYSEC-2026-2606
0.4.4 - 0.12.40 PYSEC-2026-2606
High Risk
3 months ago
LlamaIndex Vulnerable to Denial of Service (DoS)
0.12.15 - 0.12.20 PYSEC-2026-1554
0.12.15 - 0.12.20 PYSEC-2026-1554
High Risk
3 months ago
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
0.4.4 - 0.12.2 PYSEC-2026-1555
0.4.4 - 0.12.2 PYSEC-2026-1555
Critical
3 months ago
llama_index vulnerable to SQL Injection
0.4.4 - 0.12.27 PYSEC-2026-394
0.4.4 - 0.12.27 PYSEC-2026-394
High Risk
9 months ago
No summary available
0.4.4 - 0.11.6 PYSEC-2026-85
0.4.4 - 0.11.6 PYSEC-2026-85
Impacted packages
Timeline
Published
3 months ago
July 07, 2026 at 04:03 PM UTC
Fixed (0.13.0)
1 year ago
July 31, 2025 at 04:07 PM UTC
Last Modified
3 months ago
July 07, 2026 at 05:46 PM UTC