chroma-core/chroma · error · ValueError

trust_remote_code is not allowed as a kwarg to prevent arbit

Error message

trust_remote_code is not allowed as a kwarg to prevent arbitrary remote code execution

What it means

Embedding functions whose names are in _LOCAL_MODEL_LOADER_EMBEDDING_FUNCTIONS accept user kwargs through their persisted config, and configs can arrive from untrusted sources. To block arbitrary remote code execution via HuggingFace-style loaders, validate_embedding_function_kwargs_are_safe recursively scans dicts and lists for a key named 'trust_remote_code' at any nesting depth and raises this ValueError if found. It is a deliberate security guard, not a rejection of an otherwise valid option.

Source

Thrown at chromadb/utils/embedding_functions/config_validation.py:29

)


def _contains_unsafe_kwarg(value: Any) -> bool:
    if isinstance(value, dict):
        for key, nested_value in value.items():
            if key in _UNSAFE_KWARG_KEYS:
                return True
            if _contains_unsafe_kwarg(nested_value):
                return True
        return False
    if isinstance(value, (list, tuple)):
        return any(_contains_unsafe_kwarg(item) for item in value)
    return False


def validate_embedding_function_kwargs_are_safe(kwargs: Any) -> None:
    if _contains_unsafe_kwarg(kwargs):
        raise ValueError(
            "trust_remote_code is not allowed as a kwarg to prevent arbitrary "
            "remote code execution"
        )


def validate_embedding_function_config_is_safe(
    name: str, config: Dict[str, Any]
) -> None:
    if name in _LOCAL_MODEL_LOADER_EMBEDDING_FUNCTIONS:
        validate_embedding_function_kwargs_are_safe(config.get("kwargs"))

View on GitHub (pinned to aecdd12c8a)

Solutions

1. Remove trust_remote_code from the kwargs/config and use a model that loads without executing remote code (standard sentence-transformers/ONNX checkpoints).
2. If the custom model is mandatory, load it in your own process and wrap it with a custom embedding function, keeping the flag out of any persisted config.
3. Convert the custom model to ONNX or safetensors and load the local artifact instead.

Example fix

# before
kwargs = {'model_name': 'org/custom-model', 'trust_remote_code': True}
load_embedding_function(name, {'kwargs': kwargs})  # ValueError: trust_remote_code not allowed

# after
kwargs = {'model_name': 'sentence-transformers/all-MiniLM-L6-v2'}  # no remote code needed
load_embedding_function(name, {'kwargs': kwargs})

def strip_unsafe(kwargs):
    if isinstance(kwargs, dict):
        return {k: strip_unsafe(v) for k, v in kwargs.items() if k != 'trust_remote_code'}
    if isinstance(kwargs, (list, tuple)):
        return [strip_unsafe(v) for v in kwargs]
    return kwargs

safe_kwargs = strip_unsafe(user_kwargs)

from chromadb.utils.embedding_functions.config_validation import validate_embedding_function_kwargs_are_safe
try:
    validate_embedding_function_kwargs_are_safe(kwargs)
except ValueError as e:
    if 'trust_remote_code' in str(e):
        raise PermissionError('config rejected: trust_remote_code is forbidden') from e
    raise

When it happens

Trigger: Passing trust_remote_code=True in an embedding function's kwargs (constructor or config) for a local-model-loader function, or submitting a collection config JSON whose 'kwargs' subtree - including nested dicts or lists - contains that key; validate_embedding_function_config_is_safe triggers the check.

Common situations: Copying HuggingFace snippets that set trust_remote_code=True for custom-architecture models; loading community models through Chroma's local-model EFs; servers accepting client-supplied embedding configs.

Related errors

• Could not build embedding function {ef_config['name']} from
• Updating '{key}' is not supported for {NAME}
• Keyword argument {key} is not a primitive type
• Preferred providers must be a list of strings
• Preferred providers must be unique

AI-assisted analysis of chroma-core/chroma@aecdd12c8a (2026-08-16). Data as JSON: /api/errors/f5dedcb7711ce8d2. Report an issue: GitHub.