Executive brief
ChromaDB is a vector database system used for storing and querying embeddings in AI applications. An authenticated user with collection update privileges can upload a malicious embedding model that executes arbitrary code on the server when loaded. This could allow attackers to steal sensitive data, modify database contents, or pivot to attack other systems on the network.
Technical details
The vulnerability is a code injection flaw (CWE-94) in ChromaDB's update_collection API endpoint. When a user updates a collection's embedding function configuration, ChromaDB instantiates the specified model using the HuggingFace Transformers library. If trust_remote_code is set to true, this allows arbitrary Python code from the remote model repository to execute with the privileges of the ChromaDB server process. The vulnerability requires network access to the API and valid authentication with UPDATE_COLLECTION permission, but does not require additional user interaction. The model instantiation code path is reached after authentication checks, making this a post-authentication RCE vulnerability. No patch versions have been released to date; mitigation involves disabling the trust_remote_code setting in ChromaDB configuration.
Affected products
- ChromaDB chromadb 0.4.17 to 1.5.9
Timeline
- 2026-02-17: disclosed: Initial disclosure to ChromaDB security team
- 2026-06-12: advisory: Public disclosure via GitHub Security Advisory and NVD
- 2026-08-24: other: Advisory updated