Moaaz-0X

A Denial of Service (DoS) issue exists in the `request.form()` function when processing `application/x-www-form-urlencoded` requests. While limits for `max fields` and `max part size` are enforced for `multipart/form-data`, they are ignored for url-encoded bodies. This allows an unauthenticated attacker to cause resource exhaustion through two methods: sending a large number of fields (e.g., 1,000,000 fields), which blocks the worker's event loop and consumes CPU, or sending a single very large field, which forces unbounded memory allocation.

The prompt pull methods `pull prompt()` and `pull prompt commit()` in Python, and `pullPrompt()` and `pullPromptCommit()` in JS/TS, fetch and deserialize prompt manifests from the LangSmith Hub. These manifests can contain serialized LangChain objects and model configurations that influence runtime behavior. When pulling a public prompt using an `owner/name` identifier, the content is controlled by an external party. Prior versions of the SDK did not distinguish these public prompts from those within the caller's own organization, treating them as inert data rather than executable configuration. An attacker can publish a malicious prompt to the LangSmith Hub to affect applications that pull it. This can lead to Server-Side Request Forgery (SSRF), outbound request redirection, and interception of LLM traffic if the manifest configures an LLM client with an attacker-controlled `base url` or proxy. Additionally, it may allow prompt injection or behavior manipulation through attacker-controlled system messages or model parameters. The risk increases when `include model` is set to `True`, as it expands the deserialization allowlist to partner integration classes, or when `secrets from env` is enabled, allowing the reading of environment variables during deserialization.

LangChain contains runtime code paths that deserialize inputs, outputs, or other application-controlled payloads using overly broad object allowlists, specifically calling `load()` with `allowed objects="all"`. This allows attacker-supplied serialized constructor dictionaries to instantiate trusted classes with untrusted arguments. This issue can lead to Server-Side Request Forgery (SSRF), enabling access to internal services, cloud metadata endpoints, or sensitive network resources, which may result in credential theft and persistent supply-chain compromise. Applications are exposed if they accept untrusted structured input (such as JSON) without validation, preserve attacker-controlled nested dictionaries or lists in run data, and use affected API paths. Known affected surfaces include the `RunnableWithMessageHistory` class, the `astream log()` function, and the `astream events(version="v1")` function. Additionally, a secret-marker validation bypass in the ` is lc secret` function allows constructor dictionaries to avoid escaping during `dumps()` to `loads()` round-trips.