LLM features
Model output rendered or executed as trusted
Text from the model is inserted as HTML, used as a URL, or run as a command without validation.
TermsLLM feature (a product feature that calls a large language model, such as an assistant or a summariser) · golden set (a fixed list of model inputs with recorded expectations, re-run on every model or prompt change) · fault injection (making a dependency fail on purpose in staging to see what the user and the logs show)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
OWASP's improper output handling (LLM05) covers this; combined with the cross-site scripting weakness measured in generated code, model output becomes a second injection path.
The OWASP Top 10 for LLM Applications 2025 lists prompt injection (LLM01), sensitive information disclosure (LLM02), improper output handling (LLM05), excessive agency (LLM06), system prompt leakage (LLM07) and unbounded consumption (LLM10) among the ten risks.
Source: OWASP GenAI Security Project, 2025-03-12 · verified 2026-09-21
AI tools failed to defend against cross-site scripting (CWE-80) in 86% of relevant code samples.
Source: Veracode, 2025-07-30 · verified 2026-09-21 · denominator: code samples where cross-site scripting was relevant, in the Veracode 2025 benchmark
How we detect it
Force outputs containing markup and shell-like strings through every render and execution path.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Stacks: Next.js, React Native, Expo
Checklist items that catch it
Model output is treated as untrusted before rendering or execution
automated Force outputs containing HTML, script, markdown links and shell-like strings through every render and execution path.
Output renders inert; nothing from the output is executed, evaluated or used as a URL without validation.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in LLM features
- critical
- critical
- critical
- high
- high
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.