Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-14 | 1 | Patch1 |
| 2026-06-17 | 1 | Disclosure1 |
🐍 PIP — En requirements.txt: chromadb<=0.4.16 # pin previo a CVE-2026-45833 Audita: pip-audit
Post summary
The message advises pinning chromadb to an earlier version to avoid CVE-2026-45833, as identified by pip-audit.
CVE-2026-45833: ChromaDB RCE Flaw Lets Attackers Run Malicious Code https://thecybrdef.com/cve-2026-45833-chromadb-rce-flaw-lets-attackers-run-malicious-code/ #Cyberupdates #Cybertechnews #Cybersecurity
Post summary
The post announces CVE-2026-45833, an RCE vulnerability in ChromaDB that could allow attackers to run malicious code, but it does not provide technical details, exploit code, patches, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | trychroma | chromadb | - | python | - |