PyPIPackage

chromadb

4 known vulnerabilities (2 critical, 2 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-45833Critical 9.4
A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary…
Affected: from 0.4.17, through 1.5.9.
No fix released. The latest release, 1.5.9, is still affected.
CVE-2026-45831High 8.8
The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a…
Affected: from 0.5.0, through 1.5.9.
No fix released. The latest release, 1.5.9, is still affected.
CVE-2026-45830High 8.8
A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily…
Affected: from 0.4.17, through 1.5.9.
No fix released. The latest release, 1.5.9, is still affected.
CVE-2026-45829Critical 10.0
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated…
Affected: from 1.0.0, through 1.5.9.
No fix released. The latest release, 1.5.9, is still affected.