Significant-Gravitas/AutoGPT · error · ValueError

reviewed_data has excessive nesting depth

Error message

reviewed_data has excessive nesting depth

What it means

ValueError raised by check_depth when reviewed_data nests deeper than 10 levels (dicts/lists counted). It prevents stack-overflow style recursion attacks against the executor that replays this data. Pydantic surfaces it as 422.

Source

Thrown at autogpt_platform/backend/backend/api/features/executions/review/model.py:181

            else:
                return False

        if not validate_safejson_type(v):
            raise ValueError("reviewed_data contains non-SafeJson compatible types")

        # Validate data size to prevent DoS attacks
        try:
            json_str = json.dumps(v)
            if len(json_str) > 1000000:  # 1MB limit
                raise ValueError("reviewed_data is too large (max 1MB)")
        except (TypeError, ValueError) as e:
            raise ValueError(f"reviewed_data must be JSON serializable: {str(e)}")

        # Ensure no dangerous nested structures (prevent infinite recursion)
        def check_depth(obj, max_depth=10, current_depth=0):
            """Recursively check object nesting depth to prevent stack overflow attacks."""
            if current_depth > max_depth:
                raise ValueError("reviewed_data has excessive nesting depth")

            if isinstance(obj, dict):
                for value in obj.values():
                    check_depth(value, max_depth, current_depth + 1)
            elif isinstance(obj, list):
                for item in obj:
                    check_depth(item, max_depth, current_depth + 1)

        check_depth(v)
        return v

    @field_validator("message")
    @classmethod
    def validate_message(cls, v):
        """Validate and sanitize review message."""
        if v is not None and len(v.strip()) == 0:
            return None
        return v

View on GitHub (pinned to 9c8bb5550f)

Solutions

1. Flatten deep trees before submission (e.g. children-as-ids instead of nested objects)
2. Add a client-side depth check mirroring max_depth=10
3. Break cycles with reference ids

Example fix

# before
reviewed_data=deep_tree  # 15 levels
# after
reviewed_data=flatten_tree(deep_tree, max_depth=10)

function depth(obj: unknown, d = 0): number {
  if (obj && typeof obj === 'object')
    return Math.max(...Object.values(obj as object).map(v => depth(v, d + 1)));
  return d;
}
if (depth(reviewedData) > 10) throw new Error('too deep');

const withinDepth = (o: unknown, max = 10, d = 0): boolean =>
  d > max ? false : o && typeof o === 'object'
    ? Object.values(o).every(v => withinDepth(v, max, d + 1)) : true;

When it happens

Trigger: Submitting deeply nested structures — e.g. a recursively built tree, a self-referential graph serialized naively, or adversarial 20-level nested arrays. Depth is counted on both dict and list descent, so wide-but-shallow data is fine.

Common situations: Serializing org charts, ASTs, or threaded comment trees without flattening; generators that accidentally recurse (children containing themselves).

Related errors

• reviewed_data is too large (max 1MB)
• Title must not be blank
• Download failed: ${res.status}
• Invalid form
• Callback URL origin is not allowed. Allowed origins: {settin

AI-assisted analysis of Significant-Gravitas/AutoGPT@9c8bb5550f (2026-08-14). Data as JSON: /api/errors/94254ed79540cdbe. Report an issue: GitHub.