{"id":"PYSEC-2026-1308","summary":"docarray prototype pollution","details":"A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function __getitem__ of the file /docarray/data/torch_dataset.py of the component Web API. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","aliases":["CVE-2025-5150","GHSA-j9wp-865g-rf48"],"modified":"2026-07-07T17:46:38.046985555Z","published":"2026-07-07T16:02:52.954967Z","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5150"},{"type":"WEB","url":"https://gist.github.com/superboy-zjc/56502343bcb12eb653081b426debf2c8"},{"type":"PACKAGE","url":"https://github.com/docarray/docarray"},{"type":"WEB","url":"https://vuldb.com/?ctiid.310238"},{"type":"WEB","url":"https://vuldb.com/?id.310238"},{"type":"WEB","url":"https://vuldb.com/?submit.574696"},{"type":"PACKAGE","url":"https://pypi.org/project/docarray"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-j9wp-865g-rf48"}],"affected":[{"package":{"name":"docarray","ecosystem":"PyPI","purl":"pkg:pypi/docarray"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.40.1"}]}],"versions":["0.0.0","0.0.1","0.0.1.dev15","0.0.2","0.0.3","0.0.3.dev12","0.0.3.dev13","0.0.3.dev15","0.0.3.dev16","0.0.3.dev18","0.0.3.dev21","0.0.3.dev25","0.0.3.dev27","0.0.3.dev29","0.0.3.dev30","0.0.3.dev4","0.0.4","0.0.4.dev11","0.0.4.dev19","0.0.4.dev5","0.0.5.dev23","0.0.5.dev24","0.0.5.dev25","0.0.5.dev26","0.0.5.dev27","0.0.5.dev29","0.0.5.dev3","0.0.5.dev30","0.0.5.dev31","0.0.5.dev59","0.0.5.dev7","0.0.5.dev8","0.1.0","0.1.0.dev2","0.1.0.dev24","0.1.0.dev27","0.1.0.dev28","0.1.0.dev29","0.1.0.dev3","0.1.0.dev30","0.1.0.dev31","0.1.0.dev33","0.1.0.dev35","0.1.0.dev36","0.1.0.dev37","0.1.0.dev38","0.1.0.dev44","0.1.0.dev5","0.1.0.dev52","0.1.1","0.1.2","0.1.3","0.1.3.dev4","0.1.3.dev7","0.1.3.dev8","0.1.3.dev9","0.1.4","0.1.4.dev0","0.1.4.dev2","0.1.4.dev4","0.1.4.dev5","0.1.5","0.1.5.dev0","0.1.5.dev2","0.1.5.dev3","0.1.6","0.1.6.dev5","0.1.7","0.1.7.dev0","0.1.7.dev3","0.1.7.dev4","0.1.7.dev5","0.1.8","0.1.8.dev2","0.1.8.dev3","0.1.8.dev4","0.1.8.dev5","0.1.9.dev3","0.1.9.dev5","0.10.0","0.10.1","0.10.1.dev0","0.10.2","0.10.2.dev0","0.10.2.dev3","0.10.3","0.10.3.dev1","0.10.4","0.10.5","0.10.6.dev5","0.10.6.dev7","0.11.0","0.11.1","0.11.1.dev2","0.11.1.dev5","0.11.2","0.11.2.dev0","0.11.2.dev2","0.11.3","0.11.3.dev0","0.11.3.dev6","0.11.3.dev7","0.11.3.dev8","0.11.3.dev9","0.11.4.dev2","0.11.4.dev4","0.11.4.dev5","0.12.0","0.12.1","0.12.1.dev0","0.12.1.dev10","0.12.1.dev6","0.12.1.dev8","0.12.1.dev9","0.12.10.dev3","0.12.10.dev4","0.12.10.dev5","0.12.2","0.12.2.dev2","0.12.2.dev3","0.12.3","0.12.3.dev0","0.12.3.dev5","0.12.4","0.12.4.dev0","0.12.4.dev2","0.12.4.dev3","0.12.5","0.12.6","0.12.6.dev2","0.12.7","0.12.7.dev2","0.12.7.dev3","0.12.8","0.12.8.dev0","0.12.9","0.12.9.dev0","0.12.9.dev10","0.12.9.dev14","0.12.9.dev2","0.12.9.dev7","0.12.9.dev8","0.12.9.dev9","0.13.0","0.13.1","0.13.10","0.13.11","0.13.11.dev2","0.13.11.dev4","0.13.11.dev5","0.13.11.dev6","0.13.11.dev7","0.13.12","0.13.12.dev2","0.13.13","0.13.13.dev2","0.13.13.dev3","0.13.14","0.13.14.dev2","0.13.14.dev3","0.13.15","0.13.15.dev2","0.13.15.dev3","0.13.15.dev6","0.13.15.dev7","0.13.16","0.13.16.dev0","0.13.16.dev2","0.13.17","0.13.18","0.13.18.dev0","0.13.19","0.13.2","0.13.2.dev3","0.13.2.dev4","0.13.20","0.13.20.dev2","0.13.21","0.13.21.dev2","0.13.22","0.13.22.dev2","0.13.22.dev3","0.13.22.dev4","0.13.22.dev5","0.13.23","0.13.23.dev5","0.13.24","0.13.24.dev2","0.13.24.dev5","0.13.24.dev6","0.13.25","0.13.25.dev0","0.13.25.dev3","0.13.26","0.13.26.dev0","0.13.27","0.13.27.dev0","0.13.28","0.13.28.dev0","0.13.28.dev2","0.13.29","0.13.3","0.13.3.dev0","0.13.3.dev2","0.13.30","0.13.30.dev2","0.13.30.dev4","0.13.31","0.13.31.dev0","0.13.32","0.13.32.dev0","0.13.33","0.13.34.dev3","0.13.34.dev4","0.13.4","0.13.5","0.13.6","0.13.7","0.13.8","0.13.8.dev0","0.13.8.dev2","0.13.8.dev3","0.13.9","0.13.9.dev0","0.14.0","0.14.1","0.14.10","0.14.10.dev2","0.14.10.dev3","0.14.10.dev4","0.14.10.dev5","0.14.10.dev6","0.14.11","0.14.11.dev0","0.14.2","0.14.2.dev0","0.14.3","0.14.4","0.14.4.dev0","0.14.5","0.14.5.dev0","0.14.6","0.14.6.dev2","0.14.7","0.14.7.dev0","0.14.8","0.14.8.dev0","0.14.9","0.15.0","0.15.1","0.15.1.dev3","0.15.1.dev4","0.15.1.dev5","0.15.2","0.15.2.dev0","0.15.3","0.15.3.dev3","0.15.4","0.15.4.dev2","0.15.4.dev4","0.15.5.dev6","0.16.0","0.16.0.dev7","0.16.0.dev8","0.16.1","0.16.2","0.16.2.dev0","0.16.2.dev4","0.16.3","0.16.3.dev4","0.16.3.dev5","0.16.4","0.16.4.dev0","0.16.4.dev2","0.16.4.dev3","0.16.5","0.16.5.dev0","0.16.6.dev10","0.16.6.dev2","0.16.6.dev3","0.16.6.dev5","0.16.6.dev6","0.16.6.dev7","0.16.6.dev8","0.16.6.dev9","0.17.0","0.17.1.dev2","0.17.1.dev3","0.17.1.dev39","0.17.1.dev40","0.17.1.dev6","0.17.1.dev7","0.18.0","0.18.1","0.18.1.dev2","0.18.1.dev3","0.18.1.dev5","0.18.1.dev6","0.18.1.dev7","0.18.2.dev14","0.18.2.dev15","0.18.2.dev16","0.18.2.dev17","0.18.2.dev18","0.18.2.dev19","0.18.2.dev20","0.18.2.dev21","0.18.2.dev22","0.18.2.dev23","0.18.2.dev24","0.18.2.dev26","0.18.2.dev29","0.18.2.dev30","0.18.2.dev31","0.18.2.dev33","0.18.2.dev34","0.18.2.dev35","0.18.2.dev36","0.18.2.dev37","0.18.2.dev38","0.18.2.dev42","0.18.2.dev45","0.18.2.dev60","0.18.2.dev63","0.18.2.dev71","0.19.0","0.19.1","0.19.1.dev26","0.19.1.dev28","0.19.1.dev29","0.19.1.dev3","0.19.1.dev30","0.19.1.dev32","0.19.1.dev33","0.19.1.dev34","0.19.1.dev35","0.19.1.dev36","0.19.1.dev5","0.19.1.dev7","0.2.0","0.20.0","0.20.1","0.20.1.dev3","0.20.1.dev5","0.20.2.dev12","0.20.2.dev2","0.20.2.dev23","0.20.2.dev27","0.20.2.dev28","0.20.2.dev3","0.21.0","0.21.1","0.21.1.dev13","0.21.1.dev14","0.21.1.dev2","0.21.1.dev3","0.21.1.dev4","0.21.1.dev5","0.3.0","0.3.0.dev0","0.3.1","0.3.1.dev7","0.3.2","0.3.2.dev0","0.3.2.dev2","0.3.3","0.3.3.dev2","0.3.4.dev2","0.30.0","0.30.0.dev114","0.30.0.dev118","0.30.0a3","0.30.0a4","0.30.1.dev10","0.30.1.dev11","0.30.1.dev12","0.30.1.dev13","0.30.1.dev14","0.30.1.dev15","0.30.1.dev16","0.30.1.dev17","0.30.1.dev18","0.30.1.dev19","0.30.1.dev20","0.30.1.dev21","0.30.1.dev22","0.30.1.dev23","0.30.1.dev24","0.30.1.dev25","0.30.1.dev26","0.30.1.dev27","0.30.1.dev28","0.30.1.dev29","0.30.1.dev3","0.30.1.dev4","0.30.1.dev5","0.30.1.dev6","0.30.1.dev7","0.30.1.dev8","0.30.1.dev9","0.31.0","0.31.0.dev30","0.31.0.dev31","0.31.0.dev32","0.31.0.dev33","0.31.0.dev34","0.31.0.dev35","0.31.0.dev36","0.31.0.dev37","0.31.0.dev38","0.31.0.dev39","0.31.0.dev40","0.31.0.dev41","0.31.0.dev45","0.31.0.dev46","0.31.0.dev47","0.31.0.dev48","0.31.0.dev49","0.31.0.dev50","0.31.0.dev64","0.31.1","0.31.1.dev0","0.31.1.dev1","0.31.1.dev2","0.31.1.dev3","0.31.1.dev5","0.31.2.dev1","0.31.2.dev10","0.31.2.dev11","0.31.2.dev12","0.31.2.dev13","0.31.2.dev14","0.31.2.dev15","0.31.2.dev2","0.31.2.dev3","0.31.2.dev4","0.31.2.dev5","0.31.2.dev6","0.31.2.dev7","0.31.2.dev8","0.31.2.dev9","0.32.0","0.32.0.dev16","0.32.1","0.32.1.dev0","0.32.1.dev1","0.32.1.dev2","0.32.1.dev3","0.32.1.dev4","0.32.1.dev5","0.32.1.dev6","0.32.1.dev7","0.32.1.dev8","0.32.1.dev9","0.32.2.dev1","0.32.2.dev10","0.32.2.dev11","0.32.2.dev12","0.32.2.dev13","0.32.2.dev14","0.32.2.dev15","0.32.2.dev16","0.32.2.dev17","0.32.2.dev18","0.32.2.dev19","0.32.2.dev2","0.32.2.dev20","0.32.2.dev22","0.32.2.dev3","0.32.2.dev4","0.32.2.dev5","0.32.2.dev6","0.32.2.dev7","0.32.2.dev8","0.32.2.dev9","0.33.0","0.33.0.dev0","0.33.1.dev1","0.33.1.dev10","0.33.1.dev2","0.33.1.dev20","0.33.1.dev25","0.33.1.dev27","0.33.1.dev28","0.33.1.dev29","0.33.1.dev3","0.33.1.dev30","0.33.1.dev31","0.33.1.dev32","0.33.1.dev33","0.33.1.dev34","0.33.1.dev35","0.33.1.dev36","0.33.1.dev37","0.33.1.dev38","0.33.1.dev39","0.33.1.dev4","0.33.1.dev5","0.33.1.dev6","0.33.1.dev7","0.33.1.dev8","0.33.1.dev9","0.34.0","0.34.0.dev0","0.34.1.dev1","0.34.1.dev2","0.34.1.dev3","0.34.1.dev4","0.34.1.dev5","0.34.1.dev6","0.34.1.dev7","0.34.1.dev8","0.35.0","0.35.0.dev0","0.35.1.dev1","0.35.1.dev10","0.35.1.dev11","0.35.1.dev12","0.35.1.dev13","0.35.1.dev14","0.35.1.dev15","0.35.1.dev16","0.35.1.dev17","0.35.1.dev2","0.35.1.dev3","0.35.1.dev4","0.35.1.dev5","0.35.1.dev6","0.35.1.dev7","0.35.1.dev9","0.36.0","0.36.0.dev0","0.36.0.dev18","0.36.1.dev1","0.36.1.dev12","0.36.1.dev13","0.36.1.dev14","0.36.1.dev15","0.36.1.dev16","0.36.1.dev17","0.36.1.dev18","0.36.1.dev19","0.36.1.dev2","0.36.1.dev20","0.36.1.dev21","0.36.1.dev22","0.36.1.dev3","0.36.1.dev4","0.36.1.dev5","0.36.1.dev6","0.36.1.dev7","0.36.1.dev8","0.36.1.dev9","0.37.0","0.37.0.dev0","0.37.1","0.37.1.dev0","0.37.1.dev1","0.37.1.dev3","0.37.1.dev4","0.37.1.dev6","0.37.2.dev1","0.37.2.dev10","0.37.2.dev2","0.37.2.dev3","0.37.2.dev5","0.37.2.dev6","0.37.2.dev7","0.37.2.dev8","0.38.0","0.38.0.dev0","0.38.1.dev1","0.38.1.dev13","0.38.1.dev14","0.38.1.dev15","0.38.1.dev16","0.38.1.dev18","0.39.0","0.39.1","0.39.1.dev0","0.39.1.dev3","0.39.2.dev1","0.39.2.dev2","0.39.2.dev3","0.39.2.dev4","0.39.2.dev5","0.39.2.dev6","0.39.2.dev7","0.39.2.dev8","0.39.2.dev9","0.4.0","0.4.1","0.4.2","0.4.2.dev0","0.4.3","0.4.3.dev0","0.4.3.dev2","0.4.4","0.4.4.dev0","0.40.0","0.40.0.dev0","0.40.1.dev1","0.5.0","0.5.0.dev10","0.5.0.dev11","0.5.0.dev2","0.5.0.dev3","0.5.0.dev4","0.5.0.dev5","0.5.0.dev6","0.5.0.dev7","0.5.0.dev8","0.5.1","0.5.1.dev0","0.5.1.dev2","0.5.1.dev3","0.5.1.dev5","0.5.2","0.5.2.dev0","0.5.3","0.5.3.dev3","0.5.3.dev5","0.5.3.dev6","0.5.3.dev7","0.6.0","0.6.0.dev0","0.6.1","0.6.1.dev3","0.6.1.dev4","0.6.2","0.6.2.dev2","0.6.2.dev3","0.6.3","0.6.3.dev0","0.6.4.dev11","0.6.4.dev3","0.6.4.dev4","0.6.4.dev5","0.6.4.dev6","0.6.4.dev7","0.6.4.dev8","0.6.4.dev9","0.7.0","0.7.1","0.7.1.dev2","0.7.1.dev3","0.7.1.dev4","0.7.1.dev5","0.7.2","0.7.2.dev2","0.7.2.dev3","0.7.2.dev4","0.7.2.dev5","0.7.3","0.7.3.dev0","0.7.3.dev2","0.7.4.dev2","0.7.4.dev5","0.7.4.dev6","0.8.0","0.8.1","0.8.1.dev0","0.8.10","0.8.11","0.8.11.dev2","0.8.12.dev2","0.8.12.dev3","0.8.12.dev6","0.8.2","0.8.2.dev0","0.8.2.dev2","0.8.3","0.8.3.dev0","0.8.3.dev2","0.8.3.dev3","0.8.4","0.8.4.dev0","0.8.5","0.8.5.dev0","0.8.6","0.8.6.dev0","0.8.7","0.8.7.dev2","0.8.7.dev3","0.8.8","0.8.8.dev0","0.8.9","0.8.9.dev0","0.9.0","0.9.0.dev0","0.9.1","0.9.1.dev0","0.9.10","0.9.10.dev0","0.9.11","0.9.12","0.9.12.dev2","0.9.12.dev4","0.9.13","0.9.14","0.9.15","0.9.15.dev0","0.9.16","0.9.16.dev3","0.9.17","0.9.17.dev0","0.9.17.dev2","0.9.18","0.9.18.dev0","0.9.19.dev11","0.9.19.dev12","0.9.19.dev2","0.9.19.dev4","0.9.19.dev7","0.9.19.dev8","0.9.19.dev9","0.9.2","0.9.2.dev0","0.9.2.dev2","0.9.3","0.9.3.dev0","0.9.3.dev5","0.9.4","0.9.4.dev0","0.9.5","0.9.5.dev0","0.9.5.dev3","0.9.6","0.9.7","0.9.7.dev0","0.9.7.dev2","0.9.7.dev3","0.9.8","0.9.8.dev5","0.9.8.dev6","0.9.8.dev7","0.9.9","0.9.9.dev0","0.9.9.dev4","0.9.9.dev5"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/docarray/PYSEC-2026-1308.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}