PT-2025-22862 · Docarray · Docarray

Gavin Zhong · Published 2025-05-25 · Updated 2025-06-03 · CVE-2025-5150

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions docarray versions up to 0.40.1

Description A critical issue affects the getitem function of the /docarray/data/torch dataset.py file in the Web API component. This issue leads to improperly controlled modification of object prototype attributes, also known as 'prototype pollution'. The attack can be launched remotely.

Recommendations For versions up to 0.40.1, as a temporary workaround, consider disabling the getitem function until a patch is available. Restrict access to the /docarray/data/torch dataset.py file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-94

Related Identifiers

CVE-2025-5150

GHSA-J9WP-865G-RF48

Affected Products

Docarray

References · 12

• 🔥 https://gist.github.com/superboy-zjc/56502343bcb12eb653081b426debf2c8 · Exploit
• https://osv.dev/vulnerability/GHSA-j9wp-865g-rf48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5150 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5150 · Vendor Advisory
• https://github.com/docarray/docarray · Note
• https://t.me/cvetracker/24599 · Telegram Post
• https://vuldb.com/?ctiid.310238 · Note
• https://t.me/cvenotify/124462 · Telegram Post
• https://vuldb.com/?id.310238 · Note
• https://twitter.com/CVEnew/status/1926658162288906664 · Twitter Post
• https://t.me/cvenotify/123558 · Telegram Post
• https://vuldb.com/?submit.574696 · Note