Описание
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
Ссылки
EPSS
10 Critical
CVSS3
Дефекты
Связанные уязвимости
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.
ChromaDB Python project has a pre-authentication code injection vulnerability
Уязвимость прикладного программного интерфейса системы управления базами данных ChromaDB, позволяющая нарушителю выполнить произвольный код
EPSS
10 Critical
CVSS3