{"record":{"id":"f5dedcb7711ce8d2","repo":"chroma-core/chroma","slug":"trust-remote-code-is-not-allowed-as-a-kwarg-to-pre","errorCode":null,"errorMessage":"trust_remote_code is not allowed as a kwarg to prevent arbitrary remote code execution","messagePattern":"trust_remote_code is not allowed as a kwarg to prevent arbitrary remote code execution","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"chromadb/utils/embedding_functions/config_validation.py","lineNumber":29,"sourceCode":")\n\n\ndef _contains_unsafe_kwarg(value: Any) -> bool:\n    if isinstance(value, dict):\n        for key, nested_value in value.items():\n            if key in _UNSAFE_KWARG_KEYS:\n                return True\n            if _contains_unsafe_kwarg(nested_value):\n                return True\n        return False\n    if isinstance(value, (list, tuple)):\n        return any(_contains_unsafe_kwarg(item) for item in value)\n    return False\n\n\ndef validate_embedding_function_kwargs_are_safe(kwargs: Any) -> None:\n    if _contains_unsafe_kwarg(kwargs):\n        raise ValueError(\n            \"trust_remote_code is not allowed as a kwarg to prevent arbitrary \"\n            \"remote code execution\"\n        )\n\n\ndef validate_embedding_function_config_is_safe(\n    name: str, config: Dict[str, Any]\n) -> None:\n    if name in _LOCAL_MODEL_LOADER_EMBEDDING_FUNCTIONS:\n        validate_embedding_function_kwargs_are_safe(config.get(\"kwargs\"))\n","sourceCodeStart":11,"sourceCodeEnd":40,"githubUrl":"https://github.com/chroma-core/chroma/blob/aecdd12c8a891610db8653630b066b32ceb678b5/chromadb/utils/embedding_functions/config_validation.py#L11-L40","documentation":"Embedding functions whose names are in _LOCAL_MODEL_LOADER_EMBEDDING_FUNCTIONS accept user kwargs through their persisted config, and configs can arrive from untrusted sources. To block arbitrary remote code execution via HuggingFace-style loaders, validate_embedding_function_kwargs_are_safe recursively scans dicts and lists for a key named 'trust_remote_code' at any nesting depth and raises this ValueError if found. It is a deliberate security guard, not a rejection of an otherwise valid option.","triggerScenarios":"Passing trust_remote_code=True in an embedding function's kwargs (constructor or config) for a local-model-loader function, or submitting a collection config JSON whose 'kwargs' subtree - including nested dicts or lists - contains that key; validate_embedding_function_config_is_safe triggers the check.","commonSituations":"Copying HuggingFace snippets that set trust_remote_code=True for custom-architecture models; loading community models through Chroma's local-model EFs; servers accepting client-supplied embedding configs.","solutions":["Remove trust_remote_code from the kwargs/config and use a model that loads without executing remote code (standard sentence-transformers/ONNX checkpoints).","If the custom model is mandatory, load it in your own process and wrap it with a custom embedding function, keeping the flag out of any persisted config.","Convert the custom model to ONNX or safetensors and load the local artifact instead."],"exampleFix":"# before\nkwargs = {'model_name': 'org/custom-model', 'trust_remote_code': True}\nload_embedding_function(name, {'kwargs': kwargs})  # ValueError: trust_remote_code not allowed\n\n# after\nkwargs = {'model_name': 'sentence-transformers/all-MiniLM-L6-v2'}  # no remote code needed\nload_embedding_function(name, {'kwargs': kwargs})","handlingStrategy":"validation","validationCode":"def strip_unsafe(kwargs):\n    if isinstance(kwargs, dict):\n        return {k: strip_unsafe(v) for k, v in kwargs.items() if k != 'trust_remote_code'}\n    if isinstance(kwargs, (list, tuple)):\n        return [strip_unsafe(v) for v in kwargs]\n    return kwargs\n\nsafe_kwargs = strip_unsafe(user_kwargs)","typeGuard":null,"tryCatchPattern":"from chromadb.utils.embedding_functions.config_validation import validate_embedding_function_kwargs_are_safe\ntry:\n    validate_embedding_function_kwargs_are_safe(kwargs)\nexcept ValueError as e:\n    if 'trust_remote_code' in str(e):\n        raise PermissionError('config rejected: trust_remote_code is forbidden') from e\n    raise","preventionTips":["Never propagate trust_remote_code into persisted configs; choose checkpoints that load without remote code.","Run validate_embedding_function_kwargs_are_safe on any config assembled from user input.","Treat this ValueError as a security control - fix the model choice, do not bypass the check."],"tags":["chroma","security","huggingface","kwargs","remote-code-execution","config-validation"],"backgroundTag":"unsafe-kwarg-blocked","analyzedSha":"aecdd12c8a891610db8653630b066b32ceb678b5","analyzedAt":"2026-08-16T21:53:27.228Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}