ChromaDB Unauthenticated Remote Code Execution | MSSP Advisory

ChromaDB, a vector database with nearly 14 million monthly PyPI downloads, contains a max-severity vulnerability allowing unauthenticated remote code execution through its Python API server logic. Attackers can execute arbitrary code without authentication on systems running the affected ChromaDB package. The vulnerability sits in the core API server component that processes requests.

Your RMM and monitoring tools may have ChromaDB dependencies running in your environment or client networks, creating backdoor access for attackers who can execute code without credentials. Clients building AI applications or data analytics platforms almost certainly have ChromaDB deployed, and you need to tell them about this exposure before they get compromised through an unauthenticated attack vector.

📬