LangChain ChromaDB Metadata Priority Injection — RAG Poisoning Vulnerability
LangChain ChromaDB Metadata Priority Injection Vulnerability Summary LangChain's Chroma integration allows attackers to manipulate document retrieval by injecting high-priority metadata fields, forcing malicious documents to rank above legitimate ones regardless of semantic relevance. l
ORIGINAL SOURCE →via Dev.to
ADVERTISEMENT
⚡ STAY AHEAD
Events like this, convergence-verified across 689 sources, land in your inbox every Sunday. Free.
GET THE SUNDAY BRIEFING →RELATED · cyber
- [CYBER] Autonomous Vulnerability Hunting with MCP
- [CYBER] Proposal on Play Store security measures (alternative to Google's mandatory "developer verification")
- [CYBER] CVE-2026-45179 - Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses
- [CYBER] CVE-2026-45191 - Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass
- [CYBER] CVE-2026-45190 - Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass
- [CYBER] CVE-2026-45180 - Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids