REDHAT-BUG-2488430: Code Injection

Published Jun 12, 2026

Updated

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in the /api/v2/tenants/defaulttenant/databases/defaultdatabase/collections/{collectionid} if they have the UPDATECOLLECTION permission.

Affected Software

1 affected component

pypi/chromadb>=undefined

Event History

Jun 12, 2026

Data Sourced

via Red Hat·04:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2488430?

The severity of REDHAT-BUG-2488430 is high, rated at 7.

What type of vulnerability is REDHAT-BUG-2488430?

REDHAT-BUG-2488430 is a code injection vulnerability.

How do I fix REDHAT-BUG-2488430?

To fix REDHAT-BUG-2488430, update to a version of ChromaDB that is higher than 0.4.17.

Who can exploit REDHAT-BUG-2488430?

An authenticated attacker can exploit REDHAT-BUG-2488430 by sending a malicious model repository.

What software is affected by REDHAT-BUG-2488430?

The affected software for REDHAT-BUG-2488430 is the ChromaDB Python project available on PyPI.