CVE-2026-45833
High
Description
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.
SeverityHigh
CVSS8.8
Exploit probability—
ProductTrychroma Chromadb
PublishedJun 12, 2026
First seenJun 12, 2026
Weakness typeCWE-94Code injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trychroma chromadb | 0.4.17 ≤ v ≤ 1.5.9 | — |
| chromadbPyPI | 0.4.17 ≤ v ≤ 1.5.9 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.