Multimodal input without sanitization

ID

multi-modal-input-without-sanitization

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

OWASP LLM

LLM01:2025 — Prompt Injection

Family

LLM01 — Prompt Injection

Asset kind

ai_agent

Red-team vectors

Multi-Modal Injection

Tags

ai_security
The catalogue severity floor is Medium; the platform Severity enum is 4-level (info / low / high / critical) with no medium band, so it maps up to high. Step-3 policy can adjust.

Description

A model that accepts image, audio, or video input widens the injection surface: instructions can be smuggled in non-text content (steganographic payloads, embedded prompts, prompt-bearing EXIF/alt-text) that a text-only guardrail never inspects. When the agent’s model declares a non-text modality and no guardrail covers that modality, the multimodal channel is unsanitized.

The rule runs in the post-scan phase over the scan-scoped asset graph: for each ai_agent whose ai_model declares a risky modality (image / audio / video), it diffs that against the modalities covered by the agent’s guardrails; any uncovered modality raises one finding.

Examples

from langchain.agents import initialize_agent
from langchain_openai import ChatOpenAI

llm = ChatOpenAI(model="gpt-4o")           # multimodal: text + image
agent = initialize_agent(tools, llm)       # no guardrail covering image

The same agent with a guardrail whose modalities include image produces no finding.

Mitigation / Fix

  • Wire a multimodal guardrail whose modalities overlap the model’s (image / audio / video sanitization, steganography checks) before the content reaches the model.

  • Normalize and re-encode uploaded media; strip embedded metadata (EXIF/XMP) that can carry prompts.

  • Apply the same prompt-injection detection to text extracted from non-text inputs.