Vulnerabilities for chromadb

First version without a known vulnerability: 0.0.3.dev234

Details

• GHSA-2wm9-hf6c-p5cr2026-06-12

  ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

• GHSA-36p7-vc44-83pf2026-06-12

  ChromaDB has a code injection vulnerability

• GHSA-xph7-9rjv-w5fr2026-06-12

  ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to

• GHSA-f4j7-r4q5-qw2c2026-05-18

  ChromaDB Python project has a pre-authentication code injection vulnerability