9.4
Critique
CVE-2026-45833 A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated…
Description
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ChromaDB 0.4 | 0.4.17 → dernières | Pas de correctif indiqué |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions non publiées | |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées |
Références
- www.hiddenlayer.com www.hiddenlayer.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de ChromaDB
Les 6 CVE de ChromaDB →
CVE-2026-45832
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the…
8.8
Élevée
CVE-2026-45831
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project…
8.8
Élevée
CVE-2026-8828
A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users…
8.8
Élevée
CVE-2026-45830
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated…
8.8
Élevée