RAG ingest from untrusted source
ID |
rag-ingest-from-untrusted-source |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
OWASP LLM |
LLM04:2025 — Data and Model Poisoning |
OWASP ASI |
ASI06:2026 (secondary ASI08:2026) |
Family |
LLM04 — Data and Model Poisoning |
Red-team vectors |
RAG Poisoning, Indirect Injection |
Tags |
ai_security |
Description
A vector store ingests content from an external / untrusted source — a web crawler, a user upload, a mailbox, a public scrape — with no sanitisation or content guardrail on the ingest path. Hostile documents entering the index poison retrieval: the textbook RAG-poisoning door. External ingest with a content guardrail is the recommended pattern, so only the missing-sanitisation case fires.
Examples
docs = WebBaseLoader("https://public-forum.example").load() (1)
store = Chroma.from_documents(docs, embeddings)| 1 | Untrusted web ingest with no sanitisation before indexing — flagged. |
Wiring a content/sanitisation guardrail on the ingest path, or ingesting only from trusted sources, produces no finding.