This vulnerability (CVE-2026-45833) in ChromaDB version 0.4.17 or later involves improper control of code generation (CWE-94). It allows an authenticated user with UPDATE_COLLECTION permission to execute arbitrary code on the server by submitting a malicious model repository and enabling the trust_remote_code option in the API endpoint /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id}. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. The Red Hat advisory is available but does not provide explicit patch or remediation details.

Successful exploitation permits an attacker with limited privileges (UPDATE_COLLECTION permission) to run arbitrary code on the server hosting ChromaDB, potentially leading to full system compromise, data breach, or service disruption. The vulnerability affects confidentiality, integrity, availability, and security controls at a high level, making it critical in severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is stated in the Red Hat advisory, users should restrict UPDATE_COLLECTION permissions to trusted users only and avoid enabling the trust_remote_code option until a patch is available.