EUVD-2026-36484
GHSA-36p7-vc44-83pf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable HTTP endpoint, low complexity, requires an authenticated token with UPDATE_COLLECTION (PR:L), no user interaction, and arbitrary code execution yields full C/I/A impact on the ChromaDB host.
Primary rating from Vendor (HiddenLayer).
CVSS VectorVendor: HiddenLayer
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.
Articles & Coverage 2
AnalysisAI
Authenticated remote code execution in ChromaDB Python project versions 0.4.17 and later enables attackers holding the UPDATE_COLLECTION permission to execute arbitrary code on the server by submitting a malicious model repository with trust_remote_code=true to the collection update endpoint. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.4 and HiddenLayer's disclosure indicate a high-severity flaw in a widely used AI vector database. The vulnerability sits in the AI/ML supply chain layer, making it particularly relevant for organizations using ChromaDB as a backend for RAG or embedding pipelines.
Technical ContextAI
ChromaDB is an open-source Python-based vector/embedding database commonly used as the storage backend for retrieval-augmented generation (RAG) systems and LLM applications. The root cause is CWE-94 (Improper Control of Generation of Code), arising because the collection update endpoint accepts a model repository reference together with the Hugging Face transformers/sentence-transformers parameter trust_remote_code=true. When this flag is set, the loader executes Python code shipped inside the referenced repository during model instantiation, effectively turning a model-loading operation into arbitrary code execution. The affected CPE cpe:2.3:a:chroma:chromadb covers the chromadb package distributed via PyPI, and the vulnerable route is /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id}.
RemediationAI
No vendor-released patch identified at time of analysis from the supplied data; consult the HiddenLayer advisory at https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-5 and the upstream chroma-core/chroma GitHub repository for an updated chromadb release before deploying. As compensating controls, restrict the UPDATE_COLLECTION permission to a minimal set of trusted operators and audit any service accounts that hold it, since a single compromised token converts to RCE. Network-restrict the /api/v2/tenants/.../collections/{collection_id} endpoint behind an authenticated reverse proxy or service mesh policy so it is not reachable from tenant workloads, with the trade-off that legitimate collection-management tooling must be re-routed through that gateway. If your embedding workflow does not require remote model code, deploy ChromaDB behind an egress policy that blocks outbound traffic to model hosts such as huggingface.co, which prevents the malicious repository from being fetched at the cost of breaking dynamic model pulls; alternatively run the ChromaDB process under a sandboxed user with no write access to host or container secrets to limit blast radius.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today