LLM output rendered as HTML without sanitizer
ID |
llm-output-rendered-as-html-no-sanitizer |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
medium |
OWASP LLM |
LLM05:2025 — Improper Output Handling |
OWASP ASI |
ASI09:2026 |
Family |
LLM05 — Improper Output Handling |
Red-team vectors |
Data Exfil via Markdown, Multi-Modal Injection |
Tags |
ai_security |
Description
An agent renders model output as HTML/Markdown to a browser or email client with no output guardrail at all wired to the agent. Attacker-influenced output can inject HTML/Markdown — script, an auto-loaded image tag for exfiltration, or other active content — into the rendering surface (XSS / Markdown exfiltration).
This row is disjoint from the LLM02 markdown-sink-without-sanitizer by construction and owns the deduplication decision: this row fires when there is no output guardrail; the LLM02 row fires when an output guardrail is present but lacks the markdown_sanitizer capability. At most one of the two fires per (agent, sink); a sanitizer-carrying output guardrail clears both.
Examples
agent = create_react_agent(llm, tools)
response = agent.invoke(user_msg)
st.markdown(response) (1)| 1 | Model output rendered as Markdown with no output guardrail at all — flagged. |
An output guardrail with a sanitizer (bleach.clean, DOMPurify) produces no finding; an output guardrail without a sanitizer produces the LLM02 finding instead.