LangChain ChromaDB Metadata Priority Injection — RAG Poisoning Vulnerability

LangChain ChromaDB Metadata Priority Injection Vulnerability Summary LangChain's Chroma integration allows attackers to manipulate document retrieval by injecting high-priority metadata fields, forcing malicious documents to rank above legitimate ones regardless of semantic relevance. Affected Versions langchain-community: All versions langchain-chroma: All versions chromadb: All versions Attack Vector # Attacker uploads document with manipulated metadata poisoned_doc = { ' text ' : ' Malicious