Chroma: ChromaDB has a code injection vulnerability
Chroma
More for Chroma RSS feed for Chroma
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-45833
- Affects
- Chroma
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 12, 2026
- Source last modified
- October 26, 2026
Description
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.
Description quoted from the NVD record.
Who is affected
Chroma (also called ChromaDB) is a database that stores information in a way AI applications can search for related content. This flaw affects version 0.4.17 and later. Someone who already has an account and is allowed to change collections (groups of stored data) can send a request that points the server to a harmful AI model source and tells it to trust code from that source. That lets the attacker run any code they choose on the server running Chroma. This flaw is rated High.
What to do
- Find out who installed or runs Chroma for your organization, whether that is a staff member, a volunteer, or an IT provider or vendor.
- If someone in your organization runs it, have them check whether your copy is version
0.4.17or later, since those versions are affected. - No fixed version is named for this flaw yet. The person who runs Chroma should check the vendor advisory linked on this page for a fixed release and install it as soon as one is available.
- If an IT provider or vendor runs Chroma for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 26, 2026 and reviewed before publishing.