Chroma DB - Information Disclosure Detection

Chroma DB API endpoints were accessible and exposed collection metadata, enabling enumeration of collections under the default tenant and database, potentially leading to sensitive vector data disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Chroma DB API endpoints were accessible and...

GHSA-F4J7-R4Q5-QW2C ChromaDB Python project has a pre-authentication code injection vulnerability

A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trustremotecode set to true in...