A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.
An attacker with UPDATE_COLLECTION permission sends a request to the endpoint /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id}, passing a malicious model repository and the trust_remote_code parameter set to true. The trust_remote_code flag causes ChromaDB to execute code contained in the submitted repository without proper security verification. In this way, the attacker can inject and execute arbitrary code on the server side (RCE).
An attacker can execute arbitrary code on the server with ChromaDB process privileges, which may lead to full system compromise, data breach, or further lateral movement within the infrastructure.
Apply patches available from the vendor according to the references. Additionally, until the update is deployed, it is recommended to restrict access to the UPDATE_COLLECTION endpoint exclusively to trusted users and avoid setting the trust_remote_code parameter to true from unverified sources.
ChromaDB (Python project) in version 0.4.17 and all newer versions
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XTrychroma Chromadb
APPTrychroma0.4.17 – 1.5.9
Related vulnerabilities
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authen...
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python p...
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the au...