EUVD-2026-36484

🗓️ 12 Jun 2026 15:16:33Reported by EUVDType

Code injection in ChromaDB Python 0.4.17+ enables authenticated users to run arbitrary code via a malicious model repository with trust remote code and update collection.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2026-45833	12 Jun 202618:04	–	circl
CVE	CVE-2026-45833	12 Jun 202615:16	–	cve
Cvelist	CVE-2026-45833	12 Jun 202615:16	–	cvelist
NVD	CVE-2026-45833	12 Jun 202616:16	–	nvd
Positive Technologies	PT-2026-48898	12 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-45833	15 Jun 202608:35	–	redhatcve
Snyk	Arbitrary Code Injection	12 Jun 202616:39	–	snyk
vulnersOsv	01os (>=0.0.5 <=0.0.13), 1claw-crewai-tools (=0.1.0) +1776 more potentially affected by CVE-2026-45833 via chromadb (>=0.4.17 <=1.5.9)	12 Jun 202616:39	–	vulnersosv
Vulnrichment	CVE-2026-45833	12 Jun 202615:16	–	vulnrichment

[
  {
    "enisaIdVendor": [
      {
        "id": "a931e710-fe64-38e6-8a7b-cd10d9071b30",
        "vendor": {
          "name": "Chroma"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "e5e60342-1f1a-3525-a4c1-9db8599ec284",
        "product": {
          "name": "ChromaDB",
          "vendor": {
            "name": "Chroma"
          }
        },
        "product_version": "0.4.17 ≤*"
      }
    ]
  }
]

Source	Link
hiddenlayer	www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-5

12 Jun 2026 15:57Current

5.8Medium risk

Vulners AI Score5.8

CVSS 49.4

EPSS0.00342

SSVC