CVE-2025-5150: Linuxfoundation Docarray RCE Vulnerability

CVE-2025-5150 Overview

CVE-2025-5150 affects the DocArray library through version 0.40.1, a Python library maintained under the Linux Foundation for managing multi-modal data structures. The vulnerability resides in the __getitem__ function within /docarray/data/torch_dataset.py and enables improperly controlled modification of object prototype attributes, commonly known as prototype pollution [CWE-1321]. The flaw is reachable through the Web API component and can be exploited remotely with low privileges. Public disclosure has occurred, and the vendor did not respond to early notification attempts.

Critical Impact
Remote attackers with low privileges can manipulate object prototype attributes through the DocArray torch dataset interface, potentially affecting confidentiality, integrity, and availability of applications using the library.

Affected Products

Linux Foundation DocArray versions up to and including 0.40.1
Applications embedding the DocArray torch_dataset module
Web API endpoints exposing DocArray dataset functionality

Discovery Timeline

2025-05-25 - CVE-2025-5150 published to NVD
2025-06-03 - Last updated in NVD database

Technical Details for CVE-2025-5150

Vulnerability Analysis

The vulnerability stems from improper handling of attribute assignment in the __getitem__ method of torch_dataset.py. DocArray provides PyTorch dataset integration through this module, allowing indexed access to document collections. When the method processes user-controlled input during item retrieval, it fails to validate attribute names before applying them to object instances.

This weakness maps to [CWE-94] (Improper Control of Generation of Code) and [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes). The flaw allows attackers to modify shared object attributes that propagate to other instances, altering application behavior across requests.

The Web API attack surface increases exposure because DocArray is frequently deployed in machine learning serving infrastructure. An EPSS score of 0.385% places this vulnerability in the 60th percentile for likelihood of exploitation observation.

Root Cause

The root cause is missing input validation in the dataset indexing logic. The __getitem__ function in /docarray/data/torch_dataset.py accepts attribute keys without restricting access to special or inherited attributes. This permits modification of object prototype-level attributes rather than instance-only attributes.

Attack Vector

An attacker sends crafted requests to a Web API endpoint that invokes the vulnerable __getitem__ method on a DocArray torch dataset. The attacker requires low-level authenticated access but no user interaction. Successful exploitation modifies shared object state, which can cascade into downstream code paths and affect other users of the same service. Refer to the GitHub Gist PoC Repository for technical reproduction details.

Detection Methods for CVE-2025-5150

Indicators of Compromise

Unexpected attribute values appearing on DocArray document instances across unrelated sessions
Web API requests containing dunder attribute names such as __class__, __dict__, or __init__ in dataset index parameters
Anomalous application behavior following requests to endpoints backed by torch_dataset.py

Detection Strategies

Inspect HTTP request logs for index or key parameters containing Python dunder patterns targeting DocArray endpoints
Audit application logs for unexpected AttributeError or type-related exceptions originating from docarray.data.torch_dataset
Apply software composition analysis to identify deployed DocArray versions at or below 0.40.1

Monitoring Recommendations

Enable verbose logging on Web API routes that expose DocArray dataset operations
Monitor for memory or behavior anomalies in long-running ML serving processes that load DocArray
Track outbound network connections from ML inference services for signs of post-exploitation activity

How to Mitigate CVE-2025-5150

Immediate Actions Required

Inventory all services and notebooks that import DocArray and identify versions in use
Restrict Web API endpoints that expose DocArray dataset functionality to trusted, authenticated clients only
Add input validation that rejects dunder or prototype-targeting attribute names before they reach __getitem__
Isolate ML serving workloads using DocArray behind network segmentation to limit blast radius

Patch Information

As of the last NVD update on 2025-06-03, the vendor has not released a security patch and did not respond to disclosure attempts. Monitor the DocArray project for upcoming releases and review the VulDB advisory for status changes.

Workarounds

Wrap the __getitem__ call with a validation layer that allowlists permitted index types such as integers and slices
Disable or remove Web API exposure of the torch_dataset module until a fixed release is available
Run DocArray services under least-privilege accounts with read-only filesystem mounts where feasible
Apply Web Application Firewall rules to block requests containing Python attribute-traversal patterns

bash

# Pin DocArray to a known release and audit dependencies
pip show docarray | grep -i version
pip install 'docarray<=0.40.1' --dry-run
# Review which services import the vulnerable module
grep -r "from docarray.data.torch_dataset" /opt/app