Weakness (CWE)
CWE-1427: Improper Neutralization of Input Used for LLM Prompting
The product uses externally-provided data to build prompts provided to
large language models (LLMs), but the way these prompts are constructed
causes the LLM to fail to distinguish between user-supplied inputs and
developer provided system directives.
More detail
When prompts are constructed using externally controllable data, it is
often possible to cause an LLM to ignore the original guidance provided by
its creators (known as the "system prompt") by inserting malicious
instructions in plain human language or using bypasses such as special
characters or tags. Because LLMs are designed to treat all instructions as
legitimate, there is often no way for the model to differentiate between
what prompt language is malicious when it performs inference and returns
data. Many LLM systems incorporate data from other adjacent products or
external data sources like Wikipedia using API calls and retrieval
augmented generation (RAG). Any external sources in use that may contain
untrusted data should also be considered potentially malicious.
How to prevent it (6 mitigations)
-
Architecture and Design
LLM-enabled applications should be designed to ensure
proper sanitization of user-controllable input, ensuring that no
intentionally misleading or dangerous characters can be
included. Additionally, they should be designed in a way that ensures
that user-controllable input is identified as untrusted and
potentially dangerous. -
Implementation
LLM prompts should be constructed in a way that
effectively differentiates between user-supplied input and
developer-constructed system prompting to reduce the chance of model
confusion at inference-time. -
Architecture and Design
LLM-enabled applications should be designed to ensure
proper sanitization of user-controllable input, ensuring that no
intentionally misleading or dangerous characters can be
included. Additionally, they should be designed in a way that ensures
that user-controllable input is identified as untrusted and
potentially dangerous. -
Implementation
Ensure that model training includes training examples
that avoid leaking secrets and disregard malicious inputs. Train the
model to recognize secrets, and label training data
appropriately. Note that due to the non-deterministic nature of
prompting LLMs, it is necessary to perform testing of the same test
case several times in order to ensure that troublesome behavior is not
possible. Additionally, testing should be performed each time a new
model is used or a model's weights are updated. -
Installation, Operation
During deployment/operation, use components that operate externally to the system to
monitor the output and act as a moderator. These components are called
different terms, such as supervisors or guardrails. -
System Configuration
During system configuration, the model could be
fine-tuned to better control and neutralize potentially dangerous
inputs.
Source: MITRE CWE-1427
14 results · Clear filters · Feed
-
High 8.1
Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server
Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is run…
-
High 8.6
Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Too…
-
High 8.7
OpenHuman: Indirect prompt injection via background email sync executes Composio actions without user approval
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and later places it in the model cont…
-
High 8.3
OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context wit…
-
High 8.8
HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunToo…
-
High 8.8
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list a…
-
High 8.8
MoviePilot 3.1.5 Command Injection via ExecuteCommandTool
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata p…
-
High 7.3
Improper Neutralization of Input Used for LLM Prompting in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent i…
-
High 8.1
Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools
Improper neutralization of input used for LLM prompting in the python_repl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted promp…
-
High 8.8
Prompt injection bypasses shell tool consent gate in Strands Agents Tools
A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, b…
-
High 8.4
[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prom…
-
High 8.4
[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial direc…
-
High 7.2CVE-2026-44246 Public exploit
nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`
nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_no…
-
High 8.7
Multiple vulnerabilities in 1millionbot Millie chatbot
Prompt injection vulnerability in 1millionbot Millie chatbot that occurs when a user manages to evade chat restrictions using Boolean prompt injection techniques (formulating a question in such a way that, upon receiving an affirmative response ('true'), the …