A code injection flaw in ChromaDB version 0.4.17 and newer allows an authenticated attacker with the UPDATE_COLLECTION permission to execute arbitrary code on the server. By sending a malicious model repository and setting trust_remote_code to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} endpoint, the attacker can cause the server to run injected code, leading to compromise of confidentiality, integrity, and availability of the affected system.

The vulnerability affects the ChromaDB product from Chroma. All releases equal to or greater than 0.4.17 are susceptible, and the issue manifests only when the authenticated user is granted UPDATE_COLLECTION rights.

The CVSS score of 9.4 indicates a critical severity. Although no EPSS value is available, the lack of an EPSS score does not reduce the risk under the high-degree of internal or credential‑based exploitation. The vulnerability can be leveraged by any user with UPDATE_COLLECTION permissions, and as such, it is suitable for exploitation by malicious insiders or compromised accounts. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the potential for arbitrary code execution warrant urgent mitigation.