0Xn3Va

LangChain is a framework designed for building applications powered by Large Language Models (LLMs). A serialization issue exists in the `toJSON()` method of LangChain JS, impacting versions prior to 0.3.37 and 1.2.3 for LangChain, and prior to 0.3.80 and 1.1.8 for @langchain/core. This issue arises because the method does not properly escape objects containing 'lc' keys when serializing data using `JSON.stringify()`. The 'lc' key is used internally by LangChain to identify serialized objects. If user-supplied data includes this key structure, it may be incorrectly interpreted as a legitimate LangChain object during deserialization instead of being treated as plain user data. This could potentially lead to unauthorized access or manipulation of data.

Name of the Vulnerable Software and Affected Versions: LangChain versions prior to 0.3.81 and 1.2.5 Description: A serialization injection vulnerability exists in LangChain's `dumps()` and `dumpd()` functions. These functions do not properly escape dictionaries containing 'lc' keys when serializing data. The 'lc' key is used internally by LangChain to identify serialized objects. When user-controlled data includes this key structure, it is incorrectly treated as a legitimate LangChain object during deserialization instead of plain user data. This allows attackers to potentially extract sensitive information, such as environment variables, and potentially execute arbitrary code. The vulnerability is exploitable through prompt injection via LLM responses and can affect various components, including streaming operations and cached data. Recommendations: Upgrade to LangChain version 0.3.81 or 1.2.5 or later. If upgrading is not immediately possible, restrict deserialization to a predefined allowlist of trusted objects and disable automatic loading of secrets from environment variables. Treat all LLM outputs as untrusted data, especially when serialization or deserialization is involved.

An issue was discovered in GitLab-EE that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables. This issue affects versions starting with 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2.

An issue in GitLab allows a maintainer to modify a webhook URL, potentially leaking masked webhook secrets by adding a new parameter to the URL. This issue is related to an incomplete fix for a previously identified problem.

A denial of service issue allows low-privileged users to bypass file size limits in the NPM package repository, potentially causing denial of service.

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.9 through 14.0.8 GitLab CE/EE versions 14.1 through 14.1.3 GitLab CE/EE versions 14.2 through 14.2.1 Description: A Denial Of Service issue in the apollo upload server Ruby gem allows an attacker to deny access to all users via specially crafted requests to the apollo upload server middleware. Recommendations: For versions 11.9 through 14.0.8, update to version 14.0.9 or later. For versions 14.1 through 14.1.3, update to version 14.1.4 or later. For versions 14.2 through 14.2.1, update to version 14.2.2 or later.

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.10 through 14.1.7 GitLab EE versions 14.2 through 14.2.5 GitLab EE versions 14.3 through 14.3.1 Description: A specific API endpoint may reveal details about a private group and other sensitive information inside issue and merge request templates. Recommendations: For versions 13.10 through 14.1.7, update to version 14.1.7 or later. For versions 14.2 through 14.2.5, update to version 14.2.5 or later. For versions 14.3 through 14.3.1, update to version 14.3.1 or later.

The issue is related to an information disclosure problem, where a lack of access control checking allows a remote attacker to gain access to confidential data. This enables a user to read project details.