chromadb package vulnerabilities
Advisories affecting the chromadb package. A list cannot tell you whether your installed version is affected — the dependency check can.
3 vulnerabilities tracked. 1 with public exploit code.
Check which version you are running → — this page lists advisories for the package; only a version check can tell you whether you are affected.
- 9.4 A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary…
- 8.8 The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a…
- 8.8 A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that chromadb is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other packages tracked here
pypdf filelock next langflow node-forge PyJWT github.com/labstack/echo/v4 vllm github.com/labstack/echo/v5 undici nltk virtualenv react-router adminneo-org/adminneo @highcharts/dashboards pyjwt authlib litellm GitPython highcharts langchain-core seroval @highcharts/grid-pro org.mariadb.jdbc:mariadb-java-client