CVE-2025-5150

Name of the Vulnerable Software and Affected Versions docarray versions up to 0.40.1

Description A critical issue affects the getitem function of the /docarray/data/torch dataset.py file in the Web API component. This issue leads to improperly controlled modification of object prototype attributes, also known as 'prototype pollution'. The attack can be launched remotely.

Recommendations For versions up to 0.40.1, as a temporary workaround, consider disabling the getitem function until a patch is available. Restrict access to the /docarray/data/torch dataset.py file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.