https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T12:47:30.267175+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-45833 CVE-2026-45833 2026-09-30T12:47:30.270108+00:00

Affected: ChromaDB, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI)

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

 https://vulnerability.circl.lu/vuln/pysec-2026-3814 PYSEC-2026-3814 — ChromaDB has a code injection vulnerability 2026-09-30T12:47:30.270249+00:00

Affected: PyPI: chromadb

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.