CRITICAL
GHSA-f4j7-r4q5-qw2c
ChromaDB Python project has a pre-authentication code injection vulnerability
Details
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI / chromadb
Introduced in:
1.0.0 No fixed version published yet for chromadb (pip). Pin to a known-safe version or switch to an alternative.