The vulnerability is a pre‑authentication code injection flaw that lets an unauthenticated attacker execute arbitrary code on a ChromaDB server. By sending a malicious model repository and setting trust_remote_code to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint, an attacker can trigger the injection. The weakness is an unsafe code evaluation identified by CWE‑94 and it also involves unsafe deserialization of untrusted data as per CWE‑502.

Chroma’s ChromaDB product is affected. Any deployment running version 1.0.0 or later that exposes the specified API endpoint is vulnerable.

The issue has a CVSS score of 10, indicating critical severity, with no EPSS score available and it is not yet listed in CISA’s KEV catalog. Because authentication is not required, an attacker can exploit the flaw from any network position that can reach the vulnerable endpoint. Exploitation would involve crafting a payload and sending the request, which is straightforward for automated tools. The lack of a control mechanism for trust_remote_code makes the flaw easy to leverage.