[SECURITY]: ChromaDB Python project has a pre-authentication code injection vulnerability

[humanize-platform]

What happened?

Getting alert from Git:
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/{tenant}/databases/{db}/collections endpoint.

How to address this issue? Are you publishing newer version by fixing this?

Versions

= 1.0.0, <= 1.5.9

Relevant log output

[adegas-pfx]

Worth adding:

This issue is surely about CVE-2026-45829, https://avd.aquasec.com/nvd/cve-2026-45829

[fercor-cisco]

See also GHSA-f4j7-r4q5-qw2c

[xke]

@tanujnay112 , i saw that you've been making commits into this repo. Could you please help us get this issue assigned and resolved? it's an important issue to resolve soon.