PT-2025-22862 · Docarray · Docarray

Gavin Zhong · CVE-2025-5150 · Published 2025-05-25 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions docarray versions up to 0.40.1

Description A critical issue affects the getitem function of the /docarray/data/torch dataset.py file in the Web API component. This issue leads to improperly controlled modification of object prototype attributes, also known as 'prototype pollution'. The attack can be launched remotely.

Recommendations For versions up to 0.40.1, as a temporary workaround, consider disabling the getitem function until a patch is available. Restrict access to the /docarray/data/torch dataset.py file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Prototype Pollution

Weakness Enumeration

CWE-94

CWE-1321

Related Identifiers

CVE-2025-5150

GHSA-J9WP-865G-RF48

PYSEC-2026-1308

Affected Products

Docarray

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5150.json · Exploit
• 🔥 https://gist.github.com/superboy-zjc/56502343bcb12eb653081b426debf2c8 · Exploit
• https://osv.dev/vulnerability/CVE-2025-5150 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1308 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j9wp-865g-rf48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5150 · Security Note
• https://github.com/docarray/docarray · Note
• https://twitter.com/CVEnew/status/1926658162288906664 · Twitter Post
• https://github.com/advisories/GHSA-j9wp-865g-rf48 · Note
• https://t.me/cvenotify/123558 · Telegram Post
• https://vuldb.com/?submit.574696 · Note
• https://t.me/cvetracker/24599 · Telegram Post
• https://vuldb.com/?id.310238 · Note
• https://pypi.org/project/docarray · Note
• https://t.me/cvenotify/124462 · Telegram Post