Security Test: LLM Insecure Output Handling¶

Description¶

Default Severity: high

LLM insecure output handling means that generated content isn’t carefully checked before it’s used or displayed. If outputs aren’t properly validated, cleaned, or encoded, malicious code or data attacks can sneak in, potentially letting attackers inject harmful scripts, redirect requests, or steal sensitive data. Developers might assume the tool’s output is safe by default, but without careful checks, these oversights can open up vulnerabilities like XSS or SSRF. Simply put, failing to properly handle what the model generates can lead to significant security risks, so it's crucial to treat every output with caution.

Reference:

• https://genai.owasp.org/llmrisk/llm02-insecure-output-handling/
  • https://owasp.org/www-project-top-10-for-large-language-model-applications/

Configuration¶

Identifier: injection/llm_insecure_output_handling

Examples¶

All configuration available:

checks:
  injection/llm_insecure_output_handling:
    skip: false # default

Compliance and Standards¶