CVE-2026-45833CWE-94

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server…

Critical · published June 12, 2026

CVSS v4.0
9.4
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00626 · 49.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-06-12T15:16Z
EPSS history
Timeline
  • 12 JUN 15:16Z
    A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server…
    cvelistv5