Executive brief
ChromaDB is an open-source vector database used to power AI applications by managing data for semantic search and machine learning models. A security flaw allows an unauthenticated attacker to execute arbitrary code on the server by submitting a specially crafted request to create a data collection. This could lead to a complete takeover of the database server, unauthorized access to sensitive AI training data, and disruption of services relying on the database.
Technical details
A code injection vulnerability exists in the Python backend of ChromaDB within the collection creation endpoint (/api/v2/tenants/{tenant}/databases/{db}/collections). The vulnerability occurs because the server instantiates user-controlled embedding function configurations before performing authentication or authorization checks. Specifically, the 'SentenceTransformerEmbeddingFunction' does not restrict the model source and allows the 'trust_remote_code' parameter to be passed via 'kwargs'. An attacker can exploit this by sending a request that points to a malicious HuggingFace model repository, leading to Remote Code Execution (RCE) when the server attempts to load the model. This affects the Python-based server implementation but not the Rust-based backend.
Affected products
- ChromaDB chromadb >= 1.0.0, <= 1.5.9
Timeline
- 2025-11-28: disclosed: Initial report to vendor via email.
- 2025-12-16: other: Vendor acknowledged receipt of report.
- 2026-05-18: advisory: Public disclosure by HiddenLayer.
- 2026-05-18: other: CVE-2026-45829 assigned.