Registry prompt pinned to a mutable label

ID

prompt-pinned-to-mutable-label

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

OWASP LLM

LLM01:2025 — Prompt Injection

Family

LLM01 — Prompt Injection

Asset kind

ai_prompt

Red-team vectors

Prompt Injection, RAG Poisoning

Tags

ai_security

Description

A prompt fetched from a registry (LangSmith, Langfuse, …) by a floating / mutable reference — no version pin, or a mutable label such as latest — means a registry compromise (or an unreviewed edit) rewrites production behaviour without a code change. Pinning to an immutable version makes prompt rollout an explicit, reviewable step.

This detector inspects each registry prompt-fetch call site (get_prompt(…​) / pull_prompt(…​)):

  • an explicit version=…​ pin (numeric or semver) ⇒ no finding;

  • a label="latest" (or an @latest suffix) ⇒ finding;

  • a non-latest label (e.g. "prod-v2") ⇒ no finding (allowlisted);

  • no version and no label ⇒ finding (the registry default is a floating head).

The catalogue floor is "Medium"; the platform Severity enum is 4-level (info/low/high/critical) with no medium level, so the medium band maps up to high. Step-3 policy can adjust it.

Examples

system = langfuse.get_prompt("support.refund_policy")          (1)
system = langfuse.get_prompt("support.refund_policy", label="latest") (2)
1 No version pin: the registry serves the floating head, so the prompt can change under the running service.
2 An explicit latest label is equally mutable.

Mitigation / Fix

system = langfuse.get_prompt("support.refund_policy", version=3)        (1)
system = langfuse.get_prompt("support.refund_policy", label="prod-v2")  (2)
1 Pin to an immutable version.
2 Or promote a reviewed, immutable label explicitly; never latest.